> For the complete documentation index, see [llms.txt](https://docs.vault.ky/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vault.ky/security/security-model.md).

# Security model

Vault's escrow protects the funding process. It does not protect you from every risk involved in funding a project on the internet. This page states both sides plainly.

## What Vault's escrow protects

* **Custody.** Contributions sit in a campaign-specific escrow account on Solana, not in a Vault company wallet and not with the campaign creator.
* **Fixed terms.** The goal, deadline, and fee rates are locked when the campaign is created and cannot be changed afterward.
* **Automatic refunds.** If a campaign fails under its rules, refunds are processed automatically.
* **Rule-driven outcomes.** The outcome is decided by the protocol's rules, not by Vault's discretion.
* **Public verifiability.** Every campaign's funding address is public and independently auditable on any Solana block explorer.

## What Vault cannot do

* **Vault cannot stall or block the campaign state machine.** The instructions that advance a campaign are permissionless — anyone can submit them, not just Vault. If Vault goes offline, campaigns can still be progressed through their lifecycle on-chain.
* **Vault cannot change a campaign's terms after creation.**
* **Vault cannot reverse a blockchain transaction.**
* **Vault cannot recover your keys** or restore funds lost to a compromised wallet.

## What Vault's escrow does not cover

* **Project outcomes.** Escrow protects the funding process, not the success, legitimacy, or conduct of a project, creator, beneficiary, or third party.
* **Downstream fulfillment.** Even after a campaign succeeds and settlement occurs, fulfillment can be delayed, incomplete, or fail for reasons outside the escrow protocol. There is no on-chain mechanism to reverse a completed settlement.
* **Token or market performance.** Vault does not guarantee token value or project performance.
* **Wallet compromise.** Vault cannot protect you from phishing, key theft, or transactions you approve without reading.

## Audit status

Vault has completed an internal security review. **No third-party audit has been completed.**

This is stated directly rather than implied, so you can weigh it accordingly.

## Going deeper

For the account model, instruction set, deployed program addresses, and a precise statement of where on-chain guarantees end, see [Smart Contracts](/smart-contracts/overview.md) — in particular [Trust boundary](/smart-contracts/trust-boundary.md).

## Reporting a vulnerability

Send security disclosures to `security@vault.ky`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.vault.ky/security/security-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.