Protect
Threats, access paths and dependencies are identified. Controls have explicit owners and failure states.
21 Fruits reference model
Bitcoin Self-Custody
Readiness Framework.
A practical model for deciding whether a self-custody system is understandable, verifiable and recoverable—without exposing the secrets it protects.
01
The premise
Security claims need a defined boundary.
“Secure”, “verified” and “recoverable” are not general properties. Each conclusion depends on a claim, a method, a source of evidence and a point in time. The framework separates those elements so that confidence cannot silently exceed what was actually checked.
A positive result in one layer does not prove the next.
What this means for you: at the end, you know what has been shown to work, what is still open and when the next check is due. A typical result might read: “Conditional – recovery successfully rehearsed in March; instructions for relatives outdated after a device change; next check due in June.”
The framework is how 21 Fruits works. It is not an external certification or a seal of approval.
02
Four outcomes
Protect. Verify.
Understand. Recover.
Readiness is the combined result of four different capabilities.
Verify
Important claims can be checked against defined sources, with results that retain scope and time.
Understand
Roles, wallet policy, trust boundaries and stop conditions are clear to the people responsible.
Recover
Capability can be restored when a person, device, location or service is unavailable.
03
Seven review domains
Review the system,
not one device.
Each domain produces its own evidence. A weakness in one domain can invalidate confidence created elsewhere.
- 01
Authority & roles
Ownership, decision rights, operational responsibility, verification responsibility and escalation are assigned.
- 02
Wallet policy & inventory
The intended wallet, signer set, threshold, derivation information and authoritative records can be distinguished from obsolete material.
- 03
Keys, signers & access
Required components can be located and used under approved conditions without copying secrets into the review record.
- 04
Verification
Addresses, policy, transaction intent and relevant system state are checked through defined and sufficiently independent paths.
- 05
Dependencies
Devices, software, nodes, providers, locations and knowledgeable people are mapped, including procedures for when any of them is unavailable.
- 06
Recovery
A realistic exercise demonstrates that the intended system can be restored and independently verified.
- 07
Continuity
Successors or delegates can initiate the approved process, recognise uncertainty and stop when required evidence is missing.
04
Evidence states
Evidence has a state
and an expiry.
Checked against the relevant system within the defined review period.
Previously checked, but time or a material change requires a new review.
No reliable evidence supports the claim. Work remains to be done.
The required evidence source cannot presently be reached or used.
05
Decision states
The result is a decision,
not a score.
Verified
The defined claims are supported by current evidence within the stated boundary.
Conditional
The system may proceed only with documented limitations, owners and review dates.
Stop
Required evidence conflicts, is stale, unknown or unavailable before an irreversible action.
A high numerical score can hide one critical failure. The framework therefore records evidence and stop conditions instead of reducing readiness to a percentage.
06
Review cycle
Readiness must be demonstrated repeatedly.
- 01Define
State the system, claim, boundary and accountable role.
- 02Collect
Gather non-secret evidence and identify its source.
- 03Test
Exercise verification and recovery under realistic conditions.
- 04Decide
Record Verified, Conditional or Stop with open findings.
- 05Review
Repeat after time, change or any material failure.
Security boundary
The framework maps the system around the secrets.
It must never contain seed phrases, private keys, PINs, passphrases or recovery words. 21 Fruits is not a wallet, custodian or signer: 21 Fruits does not hold Bitcoin, receives no private keys and signs no transactions.
Download the four-page reference ↓