Trust & Responsibility Boundary

Trust, Risk, and Responsibility Boundary

Status: Draft
Version: v0.1
Authoritative language: English

This document defines the trust, risk, and responsibility boundaries of Havenlon as a non-custodial execution control system.

Havenlon provides hardware-enforced execution control, SaaS-based policy coordination, authorization workflows, and auditability. Havenlon does not custody assets, hold private keys, control on-chain balances, or execute transactions on behalf of users.

The purpose of this document is to clarify what Havenlon can control, what Havenlon cannot control, and where responsibility remains with the user, device holder, organization, or external legal authority.

1. Non-Custodial Responsibility Principle

Havenlon is designed as a non-custodial system.

In the Havenlon architecture:

Cryptographic keys are generated by the user or within user-controlled hardware.
Private keys remain inside local hardware.
Private keys are not exported to Havenlon SaaS.
Signing or execution occurs inside protected hardware environments.
Havenlon does not access, extract, modify, or replace user private keys.

As a result, control over assets, responsibility for key custody, and operational risk remain with the device holder or the organization operating the device.

Havenlon does not touch, store, custody, or control user digital assets.

This is a core security property of Havenlon and the foundation of its responsibility boundary.

2. Asset Risk and User Responsibility

Because asset control remains with the user or operating organization, the following risks are outside Havenlon's direct control:

Loss or destruction of private keys.
Loss, theft, damage, or compromise of hardware devices.
User mistakes or misconfigured workflows.
Unauthorized access caused by poor operational practices.
Delegating device control to an untrusted person.
Ignoring security guidance, alerts, or recommended procedures.
Physical attacks against user-controlled devices.
On-chain transactions intentionally or mistakenly executed by the user.

In these situations, Havenlon cannot recover assets, reverse transactions, reset private keys, or restore access to assets that are controlled only by the user's own keys or devices.

Havenlon may provide tools, logs, policy controls, and security guidance, but the final responsibility for asset custody and device operation remains with the user or organization.

3. Platform Capability Boundary

Havenlon provides an execution control infrastructure layer.

Havenlon can provide:

Hardware-backed execution environments.
Device identity and authorization mechanisms.
SaaS-based policy coordination.
Approval workflow orchestration.
Audit logs and operational records.
Risk detection and request blocking before execution.
Service suspension at the SaaS access layer.

Havenlon cannot:

Create user transactions without authorization.
Sign transactions for users.
Access or extract user private keys.
Transfer user assets.
Freeze on-chain balances.
Reverse blockchain transactions.
Modify on-chain state after execution.
Guarantee the value, availability, or recoverability of user assets.

Havenlon controls the execution path, not the assets themselves.

This distinction is fundamental: Havenlon can enforce whether a request is allowed to reach the controlled execution boundary, but it does not become the owner, custodian, or controller of user assets.

4. Legal Requests, Investigations, and System Response

If Havenlon receives a lawful request, regulatory inquiry, court order, or law enforcement request, Havenlon may provide information that exists within its service and operational systems.

Depending on availability and legal requirements, Havenlon may be able to provide:

Device identity records, such as serial numbers or registered device information.
SaaS account and workspace records.
Audit logs.
Cloud access logs.
Approval workflow records.
Policy configuration records.
System association records between users, workspaces, and devices.

Havenlon cannot provide:

Plaintext private keys.
Key extraction or key recovery.
Decryption of signatures into private keys.
Direct asset freezing.
Direct asset transfer.
On-chain transaction reversal.
Direct intervention in blockchain consensus or settlement.

These capabilities are outside Havenlon's technical architecture and are intentionally not available to the platform.

Havenlon may cooperate within the limits of applicable law and available records, but cooperation does not create custody or control over user assets.

5. SaaS Suspension Rights

Havenlon may suspend, restrict, or terminate access to SaaS services in certain circumstances, including but not limited to:

A device is reported lost or stolen.
A user or organization reports a security incident.
A lawful request is received from a competent authority.
Severe abnormal behavior is detected.
The service is being abused or used in violation of the applicable terms.
Continued SaaS access may create operational, legal, or security risk.

SaaS suspension may affect:

Access to cloud policy services.
Access to approval workflows.
Access to cloud-based audit views.
Access to rule updates.
Access to SaaS-managed team or workspace functions.

However, SaaS suspension does not give Havenlon control over local private keys or on-chain assets.

SaaS suspension is a service-layer action. It does not transfer ownership of assets, freeze blockchain balances, or give Havenlon the ability to sign on behalf of the user.

Depending on device configuration and local policy, a device may retain local capabilities that are outside the SaaS access layer. Havenlon cannot guarantee that SaaS suspension alone will prevent all possible offline or external use of a user-controlled device.

6. Stolen Device or Misuse Scenarios

If a device is stolen, misused, or involved in suspicious activity, Havenlon may be able to take service-layer actions.

Havenlon may:

Suspend or restrict SaaS connectivity.
Preserve available audit records.
Provide available evidence to the user or organization.
Cooperate with lawful investigations.
Block future SaaS-mediated workflows when technically and legally appropriate.

Havenlon cannot:

Roll back executed blockchain transactions.
Freeze on-chain assets.
Extract or reveal private keys.
Break cryptographic signatures.
Physically recover a stolen device.
Prevent all offline use where local device capability remains available.

Havenlon cannot replace law enforcement, judicial process, or the user's own operational security controls.

The platform may assist with evidence and service-layer restrictions, but it cannot directly intervene in blockchain settlement or asset state.

7. Custody, Regulatory, and Service Classification Boundary

Because Havenlon does not store, custody, or control user assets, Havenlon is intended to operate as a non-custodial infrastructure provider.

Havenlon should not be understood as:

A custodian.
A bank.
An exchange.
A broker-dealer.
A money transmitter by virtue of asset custody.
A digital asset holder on behalf of users.
The principal party executing user transactions.

Havenlon is designed as:

A hardware execution control system.
A policy and authorization coordination layer.
A device identity and audit infrastructure provider.
A non-custodial execution control infrastructure layer.

Regulatory classification may depend on jurisdiction, deployment model, customer use case, and applicable law. This document is a technical and operational boundary statement, not a substitute for legal advice.

8. User and Organization Responsibilities

Users and organizations operating Havenlon devices remain responsible for:

Protecting physical devices.
Managing access credentials and local PINs.
Defining safe approval policies.
Reviewing requests before approval.
Maintaining secure operational procedures.
Understanding the consequences of irreversible execution.
Complying with applicable laws and internal governance requirements.
Ensuring that authorized operators are properly trained.

Havenlon can provide execution controls, auditability, and policy enforcement tools, but it cannot replace the user's own governance, security discipline, or legal obligations.

9. Summary Boundary Statement

Havenlon is designed to enforce execution control without taking custody of user assets.

Havenlon can:

Provide hardware-enforced execution boundaries.
Coordinate policies and approvals through SaaS.
Verify device identity and authorization flows.
Block unsafe or unauthorized requests before execution.
Provide audit logs and operational evidence.
Suspend SaaS access where appropriate.

Havenlon cannot:

Access private keys.
Move assets for users.
Reverse on-chain transactions.
Freeze blockchain balances.
Recover assets lost through user error, theft, or key loss.
Guarantee the legal status or economic value of any transaction or asset.

Havenlon controls software-mediated execution pathways, not user-owned assets.

This boundary is not a limitation of the product vision. It is a deliberate security property of the system.

Software can request.
Systems can coordinate.
Hardware decides.