> ## Documentation Index
> Fetch the complete documentation index at: https://developers.fireblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Direct Custody Wallet Architecture

> [!NOTE]
>
> **Unsure about which custody model is right for you?** Read our “[Guide to Digital Asset Wallets and Service Providers](https://www.fireblocks.com/a-guide-to-digital-asset-wallets-and-service-providers)” for insights into evaluating digital asset wallet and service providers for your business

Direct custody wallets keep assets in vault accounts in your Fireblocks workspace. For non-custodial wallets inside your own application, see [Embedded Wallets](https://developers.fireblocks.com/docs/dynamic-embedded-wallets.md).

# Direct Custody Wallets

## Structure

![](https://mintcdn.com/fireblocks-43c4b3ee/8uV7V_rBjqF0ZDAg/images/docs/d76e1cc-Custodial_Wallets_1.png?fit=max\&auto=format\&n=8uV7V_rBjqF0ZDAg\&q=85\&s=f7bc3c8ee6468bf22c2a2759ea281ccc)

* The main section of the workspace is the Fireblocks Vault which holds all MPC wallets.
* Inside the Vault, an unlimited number of vault accounts can be created. This allows to segregate between distinct clients and various use cases.
* Each vault account can hold as many asset wallets as you need. However, you can only have one wallet per asset.
* In a vault account, asset wallets can accommodate numerous deposit addresses for UTXO-based assets, while account-based assets are assigned with a single address.

## Secret key management and wallet derivation

![](https://mintcdn.com/fireblocks-43c4b3ee/8uV7V_rBjqF0ZDAg/images/docs/01ed368-Secret_key_management_and_wallet_derivation_for_the_custodial_wallet_structure_.png?fit=max\&auto=format\&n=8uV7V_rBjqF0ZDAg\&q=85\&s=68cd81fe9f814b13e7df0be42e3ba7c9)

Each vault account is identified by its *vault account ID*. This identifier is used for derivation of the asset wallets in a specific vault account.

Using one master key (split into three key shards) for the entire workspace, you can create an unlimited number of vault accounts. The vault account ID acts as the account value of the derivation path.

Each asset within this specific Vault would be derived according to the following structure: m/purpose/coinType/account/change/index.

* **m**: master private key
* **purpose**: the derivation standard (BIP44 in our example)
* **coinType**: the unique identifier of an asset (0 for BTC, 60 for ETH, etc.)
* **account**: the vault account ID
* **change**: always 0
* **index**: the address index (always 0 except for UTXO based assets such as Bitcoin)