There is a lot of information here, but Safeinity strongly recommends you read and understand all of these options if you are protecting highly valuable assets.
Safeinity is designed to be secure, but the security of your documents also depends on your own computer and network security. The more valuable your documents, the more important it is that you take strong security measures.
Never fully trust any online service, no matter how secure it is.
Use Windows Security (Defender) or tools like Malwarebytes, Kaspersky, Bitdefender.
Use tools like Malwarebytes for Mac, Bitdefender for Mac, or CleanMyMac (with malware scan enabled).
Most digital storage (like a .txt or .doc file) is vulnerable to malware, cloud sync hacks, and accidental sharing.
Use Keepass
Never enter private keys on unknown or untrusted websites. Check:
Information as of mid 2025. We have no affiliation with any of these vendors - and have not tested any of these products.
Use these at your own risk.
These vendors offer laptops built for threat-model use like crypto-wallet cold storage.
Common features include: Coreboot or PureBoot, Intel-ME disabled, anti-Evil-Maid / measured-boot support, Qubes-certified devices (where noted), and options for tamper-proof delivery.
Insurgo was the first Qubes-certified X230 vendor and exceeds the certification baseline.
Among the only two certified Qubes laptops; Nitrokey also supports more modern chassis (T430).
Pioneered Intel-ME disable support among small ODMs and implemented bespoke anti-interdiction packaging.
Purism combines hardware kill-switches with cryptographically verifiable boot and anti-Evil-Maid keys.
StarBook is modern, lightweight (≈1-kg), and built with secure firmware updates in mind.
System76's policy to disable ME makes them a strong contender for advanced users.
Ideal for operators who cannot buy traceably from vendors & require supply-chain injury resistance.
KeePass Secure Password Management is a way for you to encrypt all of you data in a single file which you alone hold the key to.
This prevents brute force attacks on your data - and prevents any access even by us.
We strongly recommend you store your data in KeePass before uploading to Safeinity. We have no affiliation with KeePass.
KeePass is a free, open-source account and document manager designed to securely store and manage passwords, usernames, notes, full documents and other sensitive information in a single encrypted database file.
Developed by Dominik Reichl and maintained by a community of contributors since 2003, it is licensed under the GNU General Public License (GPL), meaning its source code is publicly available for review, modification, and auditing. This transparency fosters trust and allows security experts worldwide to ensure its robustness.
KeePass has never suffered a major breach or been defeated. Its core encryption remains uncracked in real-world scenarios.
Always download KeePass from official sources to ensure security and avoid tampered versions:
The open-source community regularly updates KeePass
Setting up and using KeePass is straightforward but requires careful configuration to maximize security:
A crypto hardware wallet is a small, dedicated device designed to securely store cryptocurrency private keys offline. Unlike software wallets or apps, a hardware wallet isolates the keys from your computer and the internet, reducing the attack surface. Popular examples include Ledger, Trezor, and Coldcard.
A hardened laptop is a standard laptop configured with strict security hardening—full-disk encryption, OS hardening, no unnecessary services, and strict network controls. It can be dedicated to crypto management, password storage (e.g., KeePass), or even air-gapped.
For everyday crypto users, a hardware wallet is the most practical balance of security and convenience. For high-value or multi-purpose security setups, a hardened laptop offers flexibility and stronger defense-in-depth—especially when used offline—but requires more expertise and careful discipline.
Goal: Ensure no single location or person holds the full seed/private key while maintaining durable, tamper-resistant backups.
(This ensures two separate copies are split and each box only contains a partial piece.)
Use Safeinity's key sharding and a threshold scheme (e.g., 2-of-3, 3-of-5) to divide the key into shares. Store shares in separate deposit boxes or with trusted custodians. Advantages: flexible quorum, better resilience, and no brittle physical-halving mistakes.
Note: many people are irresponsible with keys. Some of the people you give shards to will probably lose them. Make sure they understand the importance of their shard, and make the threshold low enough to ensure your key can be reconstructed (e.g., 5-of-10). Describe how to use the shards and about Safeinity in your will.
For extremely large holdings, consider building a shielded enclosure / Faraday cage and only accessing your hardened laptop and Safeinity from within it. This protects against electronic theft.
A properly built shielded enclosure (SE) / Faraday cage is a great physical layer control when you're using a hardened laptop for signing or accessing high-value crypto. Below is a brief overview: why you'd use one and pointers for building.
An optical interface can preserve the security advantages of an SE while still allowing limited, auditable communication: