OC Me · Federation custody

Status: this is the design, not today. No federation is bound. /api/federations is the machine-readable answer and it currently serves a single entry with no invite, so no client can join one. During bring-up OrangeCheck holds every user's accrued balance and is the party that moves it. That is a stage, deliberately: OrangeCheck operates every role until independent operators take them. Read the rest of this page as the destination, and me.ochk.io/custody as the present tense.

OC the company is not designed to be your custodian. The design is that when you sign up to me.ochk.io with email-OTP, the wallet attached to your account is held by a Fedimint federation — an M-of-N set of operationally-independent guardians that threshold-sign withdrawals together. OC integrates as a client of that federation, never as a guardian: zero key shares, no way to reach the threshold, no way to move your funds. None of that is in force until a federation is bound.

This page is the public-facing version of the operator runbook at FEDERATION-DEPLOYMENT.md in the oc-me-web repo. If you're an OC operator binding a federation, read the runbook. If you're a user, this page is enough.

What "federation custody" actually means

A Fedimint federation is a small group of independent operators (the guardians) running coordinated software. The federation as a whole issues ecash notes — bearer-form Bitcoin claims that you hold in your browser. To withdraw on-chain or send via Lightning, the federation threshold-signs on your behalf.

If this party	tries to	the result is
OC	move user funds	impossible — OC holds zero key shares
Fewer than M guardians	move user funds	impossible — threshold not met
M+ colluding guardians	move user funds	possible (this is what M-of-N means)
You	withdraw on-chain	works as long as the federation is up
You	export your wallet to another Fedimint client	works — your mnemonic is yours

The honesty of "federation custody is not OC custody" depends on the specific federation OC introduces you to. Specifically:

At least 4 guardians, threshold strictly greater than half (so 3-of-4, 4-of-7, etc.). 2-of-3 is fragile to a single guardian failure; we don't accept it for production.
Guardians operated by distinct legal entities, in distinct hosting environments, ideally in distinct legal jurisdictions. A "4 guardians" federation where they all run on the same VPS at the same provider is a single point of failure in costume.
A signed, content-addressed charter that lists every guardian, discloses their operators, and includes an exit clause for users.
At least one Lightning gateway not operated by OC.

These are the same properties the operator runbook (§1) enforces via scripts/provision-federation.ts. If a candidate federation can't satisfy them, OC doesn't bind it.

Where to find your federation's charter

Once a federation is bound, the charter (with all of the above disclosed) is published in three places:

The federation's own site / status page.
me.ochk.io's /custody page, including the SHA-256 hash of the charter so you can verify the copy you read against the one OC bound.
The operator runbook deploy log (so the bind operation is auditable after the fact).

Hash mismatch between any of those three is a red flag. If the federation amends its charter without re-publishing the new hash on me.ochk.io, file an issue at github.com/orangecheck/oc-me-web/issues.

Provisioning ceremony (what your browser does)

When you sign up via email-OTP:

me.ochk.io reads NEXT_PUBLIC_FEDIMINT_FEDERATION_INVITE and renders the wallet ceremony at /me/wallet.
Your browser lazy-loads @fedimint/core (a WASM module) and @fedimint/transport-web. Code arrives via the standard Vercel CDN over HTTPS.
The Fedimint client generates a fresh mnemonic entirely in your browser. It never leaves your machine. OC the server never sees it.
You're shown the mnemonic words and asked to write them down. The wallet is not considered ready until you confirm. This gate is the difference between "wallet exists" and "wallet is recoverable."
The client joins the federation using the public invite. From that point, your federation balance is held by the guardians, redeemable on-chain or via Lightning by you (with the federation's threshold signature) at any time.

You can re-read the source of the React provider that orchestrates this at src/lib/fedimint/provider.tsx.

What if a guardian goes down?

The federation continues to operate as long as at least threshold of the guardians are reachable. With a 3-of-4 federation, one guardian can be down indefinitely without affecting your ability to withdraw or send.

If (N - threshold + 1) guardians go down at once, the federation itself can't reach threshold and withdrawals pause until guardians are restored. This is the federation's responsibility to communicate; OC mirrors the federation's status page on /custody.

What if OC sunsets?

Per the charter's exit clause:

Your mnemonic is the only thing you need to recover the wallet in any Fedimint-compatible client. OC's UI is convenience, not custody.
On-chain withdrawal does not require OC's services to be online — the federation's threshold-signing flow is independent of OC.
You will be able to graduate to a self-custody Bitcoin wallet from /me/graduate. That page states today what it can and cannot do; the sweep opens when a federation binds.
If you'd rather pick a different federation, any Fedimint client can join it; your sats migrate via standard Fedimint cross-federation flow.

Graduating to self-custody

Not live — there is no federation balance to sweep. When one is bound, /me/graduate walks you through:

Choose a destination — your own BIP-322-compatible Bitcoin wallet, or a different Fedimint federation.
Sweep the federation balance to your destination via on-chain withdrawal (federation-signed) or via Lightning, depending on amount and destination type.
Your OC identity stays the same — what changes is the signing_method claim on your /api/auth/me payload (from fedimint_threshold to bip322 or to a different federation's fedimint_threshold). Sat-earning continues unchanged.

Current state

No federation is bound, and the browser-side Fedimint client that would have joined one was removed from oc-me-web in September 2026 — it could only ever reach its own error path, and code that demonstrates a money movement which cannot happen reads as a feature someone forgot to link up. The guardians that once ran this were torn down in July 2026. The federation operator decision is in active resolution per the criteria in FEDERATION-DEPLOYMENT.md.

So today OrangeCheck holds what you accrue. There is no stored balance to hold, strictly speaking — it is recomputed from your signed billable envelopes on every read — but the party who owes it is OrangeCheck, and that is the honest way to say it.

We are not soft-pedaling this. The in-tree audit at NON_CUSTODIAL_AUDIT.md walks the gap with file paths.

Signing in via BIP-322 gives you a real, live self-custody property — your signing key never reaches OC. It does not make your earned sats self-custodied. Those are two different questions, and conflating them is the mistake this page used to make.