Your keys.
Encrypted twice over.
Bring your Turnkey, Fireblocks, or Circle keys. We seal them with a per-developer key, then seal that key inside Vault. The plaintext never touches disk and never survives a single request.
Four steps. Two locks.
From your raw key to a double-sealed ciphertext in four short steps. Every step is logged and replayable.
Register keys
Submit your provider credentials through the API or developer dashboard. You hand the key over once. Oris owns storage from that point forward.
Generate DEK
Oris generates a fresh AES-256-GCM data encryption key bound to your developer account. Every tenant receives an independent DEK. There is no shared secret across accounts.
Double encrypt
The DEK encrypts your provider key. HashiCorp Vault Transit encrypts the DEK. Only the two ciphertexts are persisted. The plaintext DEK is wiped from memory before the request returns.
Decrypt and wipe
When your agent initiates a payment, Oris unwraps the DEK through Vault Transit, decrypts your provider key in ephemeral memory, calls your provider, and overwrites the heap region at the C level via ctypes.
Every key. In one view.
Active, rotating, or quarantined. The dashboard shows the state of every registered key. Every change is logged and queryable.
Every registered key reports its active DEK version, last access timestamp, and Vault Transit handshake state. Rotations re-wrap each DEK without downtime.
When Vault Transit rotates the KEK, every DEK is re-encrypted in place. The dashboard records the re-wrap, the new ciphertext version is durable before the old version is removed, and traffic continues to land on the active key without an interruption.
Two calls. Always safe.
Register your key once. Every payment after that decrypts, calls, and wipes on its own. Your code stays short.
The encryption complexity runs inside Oris. The SDK exposes two calls: one to register a provider key, one to pay. Everything between, the DEK fetch, the Vault unwrap, the ephemeral decrypt, the heap wipe, runs inside the request lifecycle.
# Register your Turnkey key once oris.provider_keys.save( provider="turnkey", credentials={"api_key": "tk_prod_..."}, ) # Your agent pays. Oris handles the rest. agent.pay( to="0xc1a4...f3b9", amount=12.50, chain="base", )
Three locks. Three keys.
Every credential crosses three security boundaries on the way in, and three more on the way out. Breaking one buys nothing.
Vault Transit KEK
Key material never leaves HashiCorp Vault. Rotation happens inside Vault with zero application downtime. The key encrypting key is managed entirely by the Transit secrets engine, audited through Vault's own log.
Per-developer DEK
Every developer account receives an independent data encryption key. One compromised account cannot expose another. The blast radius of any single key compromise is capped at a single tenant.
Ephemeral memory
After every API call, the plaintext key is overwritten at the C level using ctypes.memset. Python garbage collection does not handle sensitive material. The wipe is deterministic, synchronous, and observable.
What Oris does not hold.
We encrypt, decrypt, and wipe your provider credentials. That is the whole job. The funds, the license, and the provider relationship stay yours.
You stay the custodian.
Oris does not move money. Oris does not hold funds. Oris does not need a payment license to run.
You keep your accounts with Turnkey, Fireblocks, or Circle. You own the provider relationship. KYC, AML, and licensing stay between you and your provider.
Our job is the seal between your credential and any code that needs to use it. Locked at rest. Opened only in memory. Wiped after every call. That is the entire contract.
Register a key. Pay safer.
Register your provider keys and ship your first safe payment in under ten minutes. The encryption is invisible. The trail is permanent.