The signing key that is never on a networked machine.
Your HSM, MPC quorum or multisig signs offline, and the signed transaction reaches the chain as an ordinary telephone call on carrier infrastructure Minutes Network operates. An allowlist of the treasury addresses your term covers, a seat register with roles, committed capacity and an exportable audit log come with it.
Your controls stay yours.
TELRPC adds an execution path with no network stack. It changes nothing about who approves, who signs, or what gets recorded.
Your approval policy, untouched
Approvals stay where they already live: your multisig, MPC quorum or HSM signs, under the policy you run today. TELRPC carries the finished transaction and cannot add, alter or bypass a signature.
Your own lines and private trunks
Dedicated numbers, and private trunks built with you for desks that run their own telephony, on carrier infrastructure Minutes Network operates.
Audit-grade trails
Every change and every broadcast, time-ordered, with its chain, transaction id and on-chain status, exported as CSV. SLAs under contract (99.9% uptime SLA).
Segregate the signer.
Keep the broadcast keyless.
Treasury-grade offline operations separate the two jobs every online stack merges. Signing happens on a machine with no network path at all. Broadcasting happens on a grid that holds no key that can move your funds: it can carry or refuse a transaction, never alter it, redirect it or seize funds. Full compromise of the carrier path can delay a payment, and cannot redirect one.
A segregated signer
Keys are born on the signing device and never leave it. No browser, no socket, no inbound connection to defend. On the TELRPC Wallet the absence is verifiable in one command: no internet, and four permissions, CALL_PHONE, ANSWER_PHONE_CALLS, CAMERA and USE_BIOMETRIC, none of which can open a network connection.
Your HSM, your MPC
TELRPC need not be the signer. Keep signing in your HSM, MPC quorum or hardware wallets, exactly as your policy requires, and use the rail only to carry the signed transaction and to read the state a send needs. For a smaller desk, a Ledger, Trezor or BitBox02 Multi plugs into the TELRPC Wallet by USB-C cable, or a Keystone, Passport or Jade signs by QR: the keys stay in the device's custody and each send is approved on its own screen. Supported devices
A keyless broadcast
The signed bytes travel an ordinary call to the grid, which checks them and broadcasts them. TELRPC deploys no contract on any chain, and every send pays its own network fee from its own account.
Where it sits in your stack.
Your signing system keeps the key and signs as it does today. The signed transaction crosses one way to a carrying device, a locked-down handset or a treasury module, which places an ordinary call to the TELRPC Grid. The grid checks your allowlist, broadcasts the exact bytes and confirms by echo, and the audit log records every step.
Four ways to put it in the room.
From a QR read by a handset to a private trunk into the data centre. Two are available now; two are custom deployments.
Bring your own signer
Self-serveThe signing side. Your HSM, MPC quorum or multisig signs as it does today, and the finished transaction is handed to the carrying device by QR. TELRPC never becomes the signer.
Dedicated handsets
Self-serveA small fleet of locked-down phones with no internet permission, run in your treasury room; your console enrols the treasury signing addresses they carry for. A handset carries the signed transaction; your allowlisted treasury addresses broadcast on your term; the echo confirms; the audit log records.
A treasury module in the vault or data centre
Built with our teamA purpose-built appliance: a cellular voice module with a SIM, or an analogue or private line, our firmware, and a one-way input from your HSM or signing server by data diode, serial link or QR. No IP stack faces outward. The HSM signs, the module dials, the echo returns to the module.
A private trunk for the data centre
Built with our teamFor desks that already run telephony: a dedicated private trunk on Minutes Network's carrier network into the grid, with dedicated numbers, so the call never crosses the public internet.
Who it is for.
The same rail, three desks. Each keeps its signing where it is and adds an execution path with no network stack.
Exchanges: withdrawals from the cold side
- Cold-storage withdrawals signed on the cold side and carried by a handset, with no networked broadcast host attached to cold storage.
- Treasury rebalancing between your own allowlisted addresses, from the same workflow.
- Continuity when the internet or a cloud provider is down: the call still goes through.
Custodians and banks: client assets, separated duties
- Client withdrawals signed in your HSM and carried by a handset or module.
- Segregation of duties: signing system, carrying device and grid are separate layers, and none of them can alter the transaction.
- An examiner-ready trail: every change and every broadcast, time ordered, exported as CSV.
- Continuity planning: a settlement path that does not depend on your data network.
Asset managers and treasuries: settlement from the vault
- Settlement from a vault workflow: sign where you sign today, carry it out by handset.
- Allowlisted addresses: your named treasury addresses broadcast on your term until its renewal date.
- Roles and statements: a seat register recording each person's admin, operator or viewer role, and a capacity statement for finance.
Completion you can audit. Continuity you can count on.
A transaction is valid by its bytes, not its channel. The desk keeps working when the data network does not.
The confirmation echo
After a broadcast the grid calls the originating line back with a reference to the transaction id, which the signer side matches against the id it computed at signing. A completion signal tied to the transaction itself, exportable for reconciliation. How the echo works
Self-healing calls
A lost tone or a dropped call broadcasts nothing, and the same signed transaction is redialled automatically, so it lands only once. How a call recovers
When the internet is down, blocked or watched
A transaction is valid by its bytes, not its channel. Operations continue anywhere a call can be placed: an outage, a blocked network, a monitored link, a site with no data at all. Native and token sends and contract calls across the EVM family, Bitcoin, Solana and more, and swaps on Ethereum, Base, Arbitrum, Optimism, Polygon, BNB, Avalanche, Linea and Blast at a price read by call. Swap is not offered for hardware wallets.
Carrier infrastructure we operate
The grid runs on carrier infrastructure Minutes Network operates: local numbers in 93 countries on request (15 live today), a US line callable from anywhere, and a team whose day job is running voice traffic at carrier scale. Dedicated numbers and private trunks for your desk sit on the same network. See coverage
If something goes down, something else takes over.
When you onboard, we roll out your grid globally: 100% redundant, with servers around the world taking calls and tier-1 number providers from multiple countries, all different and distributed. If something goes down, something else takes over, so it is never down. You can always access your cryptocurrency, and so can your clients, over our rails.
The console and API, today.
Every institution gets the TELRPC Console for the desk and a keyed JSON API for its own systems. The API holds no key of yours and signs nothing; it reports what the grid has done and what it is set to do.
In the console
Through the API
For your risk committee.
Each control below is a property of the design, and each one is open to your team's testing during onboarding.
| Control | How TELRPC meets it |
|---|---|
| The key is never on a networked machine | The key stays in your HSM, MPC quorum or multisig, or on a TELRPC signing device with no internet permission. The carrying device receives signed bytes only, one way. |
| The carrier path cannot alter or redirect | The line carries signed bytes only. A changed byte fails the checksum or the signature, and nothing is broadcast. The worst a compromised line can do is cause a delay. |
| No key to your funds and no contract at the grid | The grid holds no key that can move your funds and deploys no contract on any chain. Its only keys are operational: a Solana co-signer limited to one fixed setup template, and a small fee-payer for setup slots. It can carry or refuse a transaction, never alter it. |
| Allowlisted addresses | The treasury addresses on your allowlist, set in your console, broadcast on your account's term. An address off the list is not covered by your term; the grid refuses it unless it holds prepaid credit of its own. |
| A seat register with roles | Each person on the account is recorded with an admin, operator or viewer role, and every seat change is in the audit log. The console does not restrict actions by role; console sign-ins are set up by grid operations. |
| A complete audit trail, exportable | A time-ordered log of every change and every broadcast, with chain, transaction id and on-chain status. Audit log and capacity statement export as CSV. |
| Availability and continuity | SLAs under contract: 99.9% uptime SLA, 99.0% call-decode target, 4-hour priority response. Local numbers in 93 countries on request, 15 live today, and a US line, reachable anywhere a call can be placed, with no dependence on your data network. |
| Redundancy and failover | Rolled out globally for every institution at onboarding: 100% redundant, with servers around the world taking calls and tier-1 number providers from multiple countries, all different and distributed. If something goes down, something else takes over, so you and your clients can always reach your cryptocurrency. |
| Onboarding alongside your security review | The TRP/1 specification, the whitepaper and the reference source are shared under licence and NDA as part of an integration, so your team examines the rail before a cent moves. Request the documents under NDA, or request the security pack. |
One payment, start to finish.
A real payment on 11 October 2026, exactly as the phone showed it. One USDC on Base, sent from a phone with no internet permission. Under three minutes from opening the send screen to the confirmation on the device.
1. Enter the payment
Asset, payee and amount. The account's sequence and fee are already on the phone, synced offline.
2. Check every line
Amount, recipient, network and fee. Placing the call signs it on the device; the key never leaves it.
3. An ordinary call
The signed transaction travels as tones, about 95 seconds for a USDC transfer. The grid checks the checksum and broadcasts the exact bytes.
4. Confirmed by echo
The grid calls back with a reference to the transaction id in the caller ID. The wallet matches it to the id it computed itself.
On-chain at 09:18:25 UTC, 11 October 2026, block 52460479: 0x54cc6d…78b1a7 on BaseScan. Phone clock shows local time (UTC+2).
Onboarding, alongside your security review.
We onboard alongside your security review and expect to be examined. Your team sees the specification before a cent moves.
Talk to us
Tell us your volumes, your signing set-up and which deployment shape fits. Read the institutions brief first if you like.
Contact usExamine the rail under NDA
The TRP/1 specification, the whitepaper, the SDK reference and the security audit pack, shared under licence and NDA.
Request under NDATest the controls
Each control on this page is open to your team's testing: the one-way hand-off, the allowlist, the seats and the audit export.
The integration guideGo live on a term
Your allowlist, seats and committed capacity are set in the console, with SLAs under contract and invoicing monthly.
See the consoleCustom terms, per seat and per transaction.
Institutional pricing is built around your volumes: per-seat fees, per-broadcast fees, dedicated-line rental, and support commitments in writing, invoiced monthly. No contract of ours on any chain. Sends are never charged a percentage. In the TELRPC Wallet, every fee is shown on the review before a swap. Branded deployments are available: your own wallet, your name on it, the grid underneath.
The construction is non-custodial: the grid holds no key to your funds and sets no output, so full compromise of the carrier path can delay a payment, and cannot redirect one. We onboard alongside your security review and expect to be examined.