Nothing here asks for blind trust.

Apsis does not hold your money

“Non-custodial” gets used loosely, so here is the specific claim: there is no key held by Apsis, by any employee, or by any server we operate that has the authority to move funds out of your vault. Not to us, not to a third party, not back to you early.

The server does hold one key, and it is worth being precise about what that key can do. It calls two functions — the one that activates a vault after funding, and the one that settles it after maturity — and both are permissionless: anyone can call them, they only succeed under conditions the contract already enforces, and they cannot direct funds anywhere other than where the contract already specifies. The key is a convenience so you don't have to pay gas and press buttons. It is not authority.

The rule every vault enforces

Each lock deploys its own contract. Its withdraw path is short enough to read in full, and it is the entire basis of the product's central promise:

• The caller must be the owner. Nobody else's address can trigger a withdrawal, regardless of what they claim or who they work for.
• The current block timestamp must be at or past the unlock time. Before that moment the call reverts. There is no argument to pass, no flag to set, and no role that exempts anyone.

There is no third branch. No admin function, no pause-and-drain, no upgradeable proxy pointing at implementation code we could swap later. The absence is the feature — an override we retained would be an override that could be compelled, socially engineered, or used.

What happens if Apsis shuts down

Your vault keeps working. It does not call back to an Apsis server to enforce its timelock, and it does not need this company to exist in order to release funds to you at maturity. If Apsis went away tomorrow you would lose the interface, the support and the automated settlement convenience — not the money. The contract address remains, the balance remains, and the withdraw function remains callable by you.

That property is the reason the product is built on a public chain rather than as a database row with a lock icon next to it. A database lock is only as durable as the company running the database.

The risks we can't engineer away

A security page that only lists strengths is marketing. These are the genuine exposures, and none of them are eliminated by anything above:

• Smart-contract risk. The vault is code, and code can contain flaws. An independent audit precedes any mainnet launch, and an audit reduces this risk rather than removing it.
• Stablecoin risk. USDC is designed to hold a one-dollar value and is issued by Circle. That is a design goal backed by reserves, not a government guarantee, and it is not FDIC insured.
• Yield-market risk. Interest comes from on-chain lending markets. Rates are variable and can fall to near zero, and in an extreme scenario a lending market can suffer losses.
• Account-access risk. Losing every login method you have is the one way to strand your own wallet, which is why Apsis requires a second login method to be linked before a first deposit.
• Illiquidity, by design. Locked money is unavailable in an emergency, without exception. This is not a bug being disclosed — it is the product — but it is a real cost and should be sized accordingly.

Specifications