Offline secrets
Recovery material is created and stored away from websites, cloud notes and support channels.
Security model
Trust the process.
Verify the evidence.
Palfu security starts with simple boundaries: secrets stay offline, sensitive actions are inspected, and release claims require published evidence.
Palfu verificationPrinciples · 01Security boundaryOFFLINE
Recovery materialNever requested online
Sensitive actionsReviewed on device
Release claimsBacked by evidence
Verify before you trust
Four layers
No single feature
carries the system.
Final hardware architecture, firmware, audits and vulnerability handling will be documented before product release. The preview does not claim certifications that have not been published.
Trusted display
Critical details are reviewed on the hardware device rather than trusted from a browser alone.
Physical confirmation
A deliberate device action separates inspection from approval.
Published evidence
Firmware verification, audits and supported integrations require links to real documentation.
Common threats
Recognise the request
that should never happen.
Type recovery words into a website
No activation, update, trading or card flow needs the secret that controls your wallet.
Approve an unread transaction
If the destination, amount, network or action is unclear, cancel and investigate.
Install from a direct message
Start at palfu.com and verify the published software route and release details.
Pay for urgent “support”
Legitimate support does not need remote access, a transfer or your private keys.
Shared responsibility
Hardware helps.
Habits finish the job.
Palfu’s responsibility
- Publish verifiable software and device information
- Explain sensitive actions before confirmation
- Maintain a clear vulnerability reporting route
- Never collect recovery phrases or private keys
Your responsibility
- Protect recovery material and device access
- Verify addresses, networks and prompts
- Use current software from the official route
- Stop when a request feels urgent or unclear