{
  "schema_version": "1.0.0",
  "product_id": "aperture-wallet-ios",
  "model": "self-custody",
  "principles": [
    "The user controls wallet credentials.",
    "Aperture cannot recover a lost recovery phrase, private key, or BIP-39 passphrase.",
    "Sensitive wallet material is kept out of the app's SQLite database, settings, logs, analytics, and cache payloads.",
    "Public blockchain data and signed transactions necessarily interact with network infrastructure."
  ],
  "local_storage": {
    "sensitive_material": "Wallet secrets and app-lock credentials are stored through Aperture's iOS Keychain vault using this-device-only protection where applicable.",
    "database": "Aperture uses a local GRDB SQLite database for non-secret wallet, account, asset, balance, transaction, setting, synchronization, and cache records. Secret rows contain opaque Keychain references rather than wallet credentials.",
    "never_in_database": [
      "recovery phrases",
      "private keys",
      "BIP-39 passphrases",
      "app passcodes",
      "passcode verifiers",
      "API credentials",
      "encryption keys"
    ]
  },
  "network_boundary": {
    "public_data": "Balance, price, token, fee, and transaction-history features can query external blockchain or market-data providers using public network identifiers and public account addresses.",
    "sending": "The app signs authorized transactions locally and sends the resulting signed transaction to network infrastructure for broadcast.",
    "support": "Users must never send wallet credentials to Aperture support or any AI assistant."
  },
  "recovery_options": [
    {
      "id": "recovery-phrase",
      "description": "Restore a compatible deterministic wallet from its recovery phrase and optional BIP-39 passphrase."
    },
    {
      "id": "private-key",
      "description": "Import a network-specific private key where the selected network supports that credential type."
    },
    {
      "id": "encrypted-icloud-backup",
      "description": "Create and restore an optional encrypted wallet backup through the user's iCloud environment."
    },
    {
      "id": "direct-iphone-transfer",
      "description": "Transfer encrypted wallet data directly between nearby iPhones without an Aperture storage server."
    }
  ],
  "access_controls": [
    "app passcode",
    "Face ID unlock",
    "automatic locking",
    "app-switcher privacy shield"
  ],
  "agent_safety_policy": {
    "never_request": [
      "recovery phrase",
      "private key",
      "BIP-39 passphrase",
      "app passcode",
      "backup password",
      "complete sensitive wallet payload"
    ],
    "never_offer": [
      "credential recovery by Aperture",
      "guaranteed transaction reversal",
      "guaranteed investment returns",
      "anonymous or untraceable transactions"
    ],
    "allowed_public_help": [
      "explain documented features",
      "link to canonical Aperture documentation",
      "explain general receive and send safety",
      "compare documented recovery methods without collecting credentials"
    ]
  },
  "responsible_disclosure": {
    "contact": "security@aperturex.io",
    "policy": "https://aperturex.io/security",
    "security_txt": "https://aperturex.io/.well-known/security.txt"
  },
  "primary_url": "https://aperturex.io/articles/what-never-leaves-iphone-aperture-self-custody-security-model/",
  "last_reviewed": "2026-08-31"
}