What GeoSafe is designed to survive — and what it can't do.

Anyone with your key can sign. Only you can spend. The chain asks "valid signature?"; GeoSafe asks "should this happen?" A GeoSafe Vault is a smart-contract account you own. It needs your wallet and your phone to sign. GeoSafe can't sign alone, can't start a withdrawal and can't shorten a wait. Recovery works without us.

What it needs from you

• Your phone. One registered phone per Vault, with its key held in the phone's secure hardware. Face ID or PIN at every approval.
• Your zones. Safe zones you choose. Inside one, an approved withdrawal executes now if you switched instant approval on for that zone. Outside — or with it off — it waits for the time you set, and then still needs your approval.
• Your linked wallet. Withdrawals go only to the wallet you connected. There is no free-form address. If that wallet's seed phrase leaks, your Vault is still safe — leave it where it is and don't withdraw to that wallet; re-linking the Vault to a fresh wallet is a protection change, so it is never instant.

What it survives

• A stolen seed phrase. The thief has your seed phrase, not your phone or your zone. It gives them your wallet, and that is where it ends: a wallet can start a withdrawal but never finish one, and connecting it to GeoSafe gets nowhere near your Vault. Reaching that takes your registered phone, or your zones.
• A stolen phone, even unlocked. Unlocking the phone isn't enough: every approval needs Face ID or your GeoSafe PIN. If your PIN is compromised too, the wait is what buys you time — outside your zones nothing moves until it ends. You take the Vault back on a new phone with your recovery zones.
• A faked location. A spoofed location without your phone and your face is nothing. A new phone still needs your recovery zones and the wait.
• GeoSafe compromised, or gone. The rules live in the contract, not on our servers. Recovery uses your chosen zones and a fixed 48-hour delay, and needs nothing from GeoSafe.

What we don't claim

We don't claim prevention. We claim that one failure is never enough — including ours. An independent audit of the Vault contract is scheduled before public launch; the auditor's report, the verified contract address and the documented way to withdraw without the GeoSafe app will all be published on this page before anyone is asked to trust it with real value.

Recovery

You choose 2 or more recovery zones when you set up — more than one, because a single zone is guessable by someone who knows you, and each extra zone multiplies what an attacker would have to try. Unlike a Safe zone, you never have to be there: recovery zones are points you pick on a map, so one can be in Lagos and the next in Lisbon. Keep them well away from where you live — GeoSafe asks for at least 50km and warns you if they are closer. Spreading your zones apart from each other helps too. Neither is enforced: you can put both zones on the same street and GeoSafe will still let you. It is a weaker choice, and it stays yours to make. To restore on a new phone you reproduce those zones on the map; the key is re-derived, with a retry throttle and a fixed 48-hour delay. If someone else starts a recovery on your Vault, you are told, and you can stop it with your own zones before the delay runs out. There is no phrase to write down and none to steal. Your zones are a secret, not a location check: choose zones only you would know, guesses are throttled, and even a correct match waits 48‑hours before anything moves.