“We Can’t See Your Data” vs “We Won’t Look”: The Custody Privacy Litmus Test

Most Bitcoin custody marketing protects your coins. Almost none of it protects your privacy. In June 2026, a new vault provider called XYZVault showed up on Stacker News with a sharp framing of the difference, and the post became one of the most engaged multisig discussions of the year: 23.8k sats and 13 comments. The framing is worth your attention regardless of what you think of the vendor.

One warning up front: everything about the company’s architecture below is their claim, not independently verified fact. I will flag that each time, because the distinction the post draws is exactly about not taking companies at their word.

The litmus test

XYZVault’s proposed test is simple: if a vault service can report its total assets under custody, or if it charges you a percentage of your holdings, then it can read every customer’s balance. Full stop. A provider that prices off your stack size necessarily knows your stack size.

The company claims it cannot produce that number for its own platform. That is a strong claim, and it is the right kind of claim: falsifiable in principle, structural rather than promissory. “We can’t see your data” is a statement about architecture. “We won’t look” is a statement about intentions. Architecture beats intentions, because intentions change and math does not.

The architecture, as the vendor describes it

All of the following comes from XYZVault’s own posts, and I could not independently verify it. Their site is referenced as xyzvault.io, but a direct check of the site failed, so treat everything here as vendor claims:

• 2-of-3 multisig vault. The company holds 1 of 3 keys. The user holds the other two on hardware wallets. The company can never move funds alone.
• Browser-side encryption. Encryption happens in the user’s browser. The passphrase-derived key never leaves the browser. Servers store only ciphertext: vault names, device info, wallet configuration, everything.
• No balance or history storage. The company claims it stores no addresses, balances, or transaction history. The browser derives addresses locally and queries a blind proxy to a private Bitcoin node that relays data without linking addresses to users.
• Enclave-enforced spending rules. Spending rules like address allowlists, daily limits, and hold timers are stored encrypted and enforced inside a secure enclave, changeable only with a hardware-wallet signature.
• Recovery without the company. If XYZVault disappears, the user sweeps funds into Sparrow with their two keys. No company cooperation needed. That only works if you kept the wallet descriptor: seed words are not enough to recover a multisig.

If true, this is a meaningful step beyond the standard assisted-custody model, where the co-signer typically sees your full balance and holds your email. The August 2026 discussion of Nunchuk’s platform key showed exactly that privacy cost: identity tied to the wallet, balance visible to the co-signer.

How to evaluate claims like these

The vendor’s framing gives you the tool to evaluate the vendor. Ask of any custody provider:

1. Can they tell you their total assets under custody? If yes, they read balances.
2. Do they charge a percentage of holdings? If yes, they read balances.
3. Do they require an email or phone number? If yes, they link identity to the wallet.
4. As a co-signer, what exactly can they see? Get the specific answer, not the marketing answer.
5. If the company vanished tomorrow, could you recover with standard open-source tools? If no, you do not have self-custody, you have an account.

“Can’t see” is a high bar. Most providers in the market today are “won’t look” at best. Knowing which one you are buying is the entire game.

For comparing assisted options against pure DIY multisig, the multisig wizard lays out the tradeoffs, and the best bitcoin wallet comparison covers the hardware side. The compatibility checker shows which coordinators support assisted-multisig workflows.

Discussed on Stacker News: XYZVault – “we can’t see your data” vs “we won’t look” which one matters to you?