Business and Enterprise Key Replacements (hardware device key rotation)

Key replacement is required under several circumstances, including:

- Changes in employee roles or staff departures

- Loss, damage, or theft of a hardware device

- Actual or suspected compromise of seed phrase or backup credentials

- Internal policy updates or changes in corporate governance

Casa’s platform facilitates seamless and secure key replacement in compliance with institutional controls, ensuring ongoing asset security under an updated keyset.

Key replacement is a sensitive security action and must be completed by a designated vault administrator. Casa will notify all relevant key managers via email when a key has been flagged for replacement or when they are added or removed as key managers.

To initiate a key replacement, the vault admin should:

1. Log in to the Casa app, navigate to the BTC or ETH vault, and select the key icon in the upper right corner.

2. Review the list of vault keys and select the key requiring replacement.

3. Once prompted, choose “Replace Key.”

4. Review the disclosure and confirm your understanding that the previous key will be retired by selecting “Yes, confirm.”

5. The system will process the update, returning you to the vault keys list. The replaced key will display a yellow “Connect Key” status, indicating readiness for assignment.

6. Tap the key and designate the new or existing key manager responsible for holding the key; update or add another individual as needed.

7. Select “Save.”

8. On the subsequent screen, specify the brand of hardware device to be used for the new key, then tap “Continue.”

9. Casa will notify the selected key manager by email.

The key manager should unbox and initialize the replacement hardware wallet, install the required BTC or ETH application per manufacturer guidance, and follow the instructions provided via email to complete device connection and key addition.

For bitcoin vaults: Once the above steps have been completed, a recovery transfer will be necessary to ensure funds are secured by the new keys going forward. To sign the transfer transaction, a quorum of signatures will be required from your original keyset.

For ethereum vaults, a recovery transfer is not required, but a small amount of gas must be paid in ETH to update the smart contract. Paying the gas will require signing with three keys from your original keyset.