Alerting pages a person, not a dashboard. A hot standby takes over automatically, and the switch is a signing handoff — blocks, not minutes.

Every release runs on our testnet node first, then mainnet. Routine releases inside 24 hours of the announcement; emergency releases inside one hour.

A named engineer and a shared channel with your team from day one, plus a security address that reaches the on-call rotation. Outreach is answered the same day.

We join at testnet and keep the testnet node for as long as we hold the mainnet seat, so the chain's early weeks are ours too.

If something on our side affects your chain, we publish a post-mortem in your validator channel: what happened, when we knew, and what we changed.

Bare metal across two regions and two providers, chosen per chain against the validator set's current map so we never add to a concentration you are trying to reduce. We are based in India, where few validators are — a seat with us is geography most sets do not have.

Prometheus endpoints scoped to your team, so you watch the same numbers we do. A bridge or archive node where the chain wants one. Nothing on trust.

Stock binaries, no MEV side-channels, a separate full node for anything public, KYB documents ready, and commission set per chain under that chain's cap.

Dashboards, an Ansible repository, alert rules and guides, published for the chains we run — so the next operator starts further along than we did.

Arrives at both regions' sentries on one port and reaches both validators over private peering; the standby stays in sync. Only the live one asks the cosigners, who agree two of three, and the signed vote leaves the way it came.

Three shards, on three hosts. Two agree and the result is dialled to the validators — never the other way. The whole key exists nowhere.

Joins the tailnet on a tagged laptop and can reach every host inside it — SSH only from inside, a hardware key, a named account, an allow-list of commands. Which hosts each person may reach is a policy file in Git. Every command is audited and shipped to monitoring.

Sees two ports from outside: the sentries', which can be replaced under them, and the full nodes', which hold nothing. Every other port on every host is closed by a default-deny firewall. No route to a validator. No route to a shard.

The consensus key is generated as three shards on three hosts with a 2-of-3 threshold. Signatures come from multi-party computation: the whole key never exists anywhere — not on disk, not in memory, not at signing time.

Each shard on its own host and network segment, no inbound ports. A cosigner dials the validator; nothing dials in. Own one host and you hold a shard, which is worthless alone.

Every cosigner keeps the high-water mark, and a signature needs two of them to agree — so the same height is never signed twice, even mid-failover.

Split across separate signers and people. No one person can move stake, change commission or rotate a key alone.

No HSM, so it runs on cloud and on bare metal alike. Lose a cosigner and the other two keep signing; a single signer with a hardware module stops dead.

The signing layer is connected to both hosts and signs on A. B is in sync and idle, on a different provider in a different region.

Provider outage, fibre cut, fire. The cosigners see A stop answering. Nothing else on the network notices yet.

Signing moves to B. The high-water mark rules out signing the same height twice, which is what makes the switch safe.

It rejoins as the standby. No one touched a key; the ceremony stays where it belongs.

We acknowledge in your channel the same day and confirm when we will move — the scheduled point if the chain sets one, otherwise our own window.

The new release runs on our testnet validator first. Anything that breaks, breaks there.

Applied by the on-call engineer with a second engineer watching the standby; the standby moves first, so a bad release never takes the live host down.

Signed blocks on the new version, reported back to you. Routine releases inside 24 hours of the announcement; emergency releases inside one.

Missing blocks is a monitoring failure. Small and recoverable on most chains, but delegators see it and foundations count it — which is why alerting pages a person, not a dashboard.

Signing two blocks at one height is almost never an attack; it is a failover done wrong. The penalty is severe and on many chains permanent. The 2-of-3 signature and every cosigner's high-water mark are what rule it out.