Cowrie Research

station70

4 min read

Station70

  • Name: Station70
  • URL: https://www.station70.com/
  • Category: institutional recovery-and-credential security company / digital-asset business-continuity operator / agent-secrets policy engine / enterprise identity hardening vendor
  • Summary: Station70 clears the bar for a company note because the useful question is not only what do Bunker, Castle, or Gatekeeper do? but which named operator packages the recovery-response service, quorum and backup-attestation workflow, enclave and HSM trust shell, policy-evaluated secret release, and audit-ready evidence path institutions may start treating as operational truth? The product family matters, but the sharper dependency is the company-run security-and-continuity perimeter around those products.
  • What it does:
    • Operates Bunker as an institutional disaster-recovery and business-continuity product for digital-asset wallet operations
    • Packages zero-knowledge backup, wallet-account migration, recovery-response, and backup-attestation workflow around existing institutional custody stacks
    • Sells Castle as an MPC-and-secure-enclave enterprise authentication product tied to shared-account and threshold-approval hardening
    • Sells Gatekeeper as a policy engine, zero-knowledge secrets vault, and MCP gateway for human and agent access to credentials and tools
    • Runs the surrounding trust, audit, compliance, and deployment shell that customers inherit across SaaS, self-hosted, and dedicated-instance rollouts
  • Key claims:
    • The homepage says Station70 is building institutional grade security products protecting keys, identities, and access, which is a stronger clue that the company is trying to own a broad enterprise security control plane rather than one narrow wallet-recovery feature
    • The Bunker launch post says the first product is meant to simplify private-key backup and recovery, offers a Recovery Response Service, and is aimed at institutions worried about self-custody operational failure rather than generic wallet UX
    • The earlier Bunker materials collected in ../whitepapers/station70-primary-sources-2026-04-27.md describe zero-knowledge wallet-account migration, Secure Wallet Account Transfer, verifiable backup reports, configurable cryptographic quorums, Nitro enclaves, and HSM-backed recovery architecture
    • The Castle materials in that same source capture position the company as using battle-tested MPC plus secure mobile enclaves for enterprise authentication, shared-account protection, and Okta / Azure AD integration rather than staying limited to crypto-only backup tooling
    • The current Gatekeeper page says a human or AI agent authenticates through a gateway, policy is evaluated before release, secrets are injected directly into the approved session with scoped and time-bound permissions, and every request and approval is logged to an exportable audit trail
    • The Gatekeeper page also says policy can be scoped across identity, role, agent, client app, resource, network boundary, session duration, spend caps, rate limits, transaction size, and human-approval step-up, which makes the company look like a credential-and-policy operator rather than a passive vault vendor
    • The homepage says Station70 maintains SOC 2 Type 2 compliance, annual penetration testing, and independent cryptography audits, while the earlier source capture notes a blog post claiming audit scope across Nitro enclave operations, quorum enforcement, and attestation reporting
  • Whitepaper: No separate company whitepaper is the point here. The strongest current materials are the official site, Gatekeeper page, launch post, and the earlier primary-source capture in ../whitepapers/station70-primary-sources-2026-04-27.md.
  • Sources:

Internal linkages

  • Legacy project alias: station70.
  • Useful adjacent operator reads: coincover, fireblocks, and fordefi.
  • Useful adjacent security-and-policy read: eigen-labs for a different hosted coordinator plus policy shell shape around sensitive enterprise workflow.

Protocol / company boundary

  • Keep this company note on the named operator boundary: recovery-response packaging, backup-attestation workflow, quorum and evidence design, policy-evaluated secret release, audit export, and the enterprise trust shell around Bunker, Castle, and Gatekeeper.
  • Do not force a separate project note right now. Station70 is already the company name, and the analytically useful split is between the named operator shell and its product lines, not between some neutral protocol and the operator.
  • That matters because how does Gatekeeper inject a scoped secret? and which company controls the hosted policy engine, audit trail, deployment shape, and recovery-response path around that flow? are related but not identical questions.

Control surface

  • Practical leverage sits in customer onboarding, deployment mode, quorum and recovery-policy packaging, backup-attestation cadence, enclave and HSM trust assumptions, human-approval workflow, credential-release policy, audit-log export, and the degree to which emergency or sensitive paths still depend on Station70-operated infrastructure.

  • The useful point is not merely that Station70 sells security products. It is that one named company can become the continuity, credential, and emergency-policy shell around an institution’s existing custody and agent stack.

  • Read Station70 as institutional survivability and credential-governance infrastructure, not as a base custody protocol.

  • Last reviewed: 2026-08-09 UTC

Graph View

Backlinks