Do I need a recovery kit if my gateway is custodial?

Recovery kits are a non-custodial concept: they preserve your independent access to addresses derived on your behalf. A custodial platform holds your funds in its own wallets, so there is nothing for you to re-derive, and your protection questions are different ones about solvency, regulation, and withdrawal terms.

When should I download and refresh the kit?

Download it as part of onboarding, before any payment needs it, and refresh it when the platform tells you the derivation scope changed, typically after registering a new treasury or wallet configuration. A stale kit still recovers everything it describes. It just may not know about addresses created after it was generated.

Can someone who steals my recovery kit take my funds?

The kit contains derivation inputs, not private keys, so a thief can compute your forwarder addresses but cannot spend from them: forwarders only pay your treasury, and sweeps are signed with keys the kit never held. Treat it as sensitive anyway, since it maps your payment history, but it is not a wallet backup.

Has self-recovery ever actually been needed?

The honest answer for most gateways including this one is that the kit is insurance, engineered and tested rather than battle-worn. The test that matters is reproducibility: the derivation is pinned by automated parity tests between platform and tool, so recovery does not depend on anyone remembering how anything worked.

What a payment recovery kit is and why it matters

A payment recovery kit is a downloadable bundle that lets a merchant re-derive every per-payment address their gateway ever assigned them, and sweep any funds sitting at those addresses, without the gateway's servers existing anymore. It is the answer to the sharpest question you can ask a non-custodial gateway: if you vanished tonight, could I still reach everything? For most of a merchant's funds the answer is trivially yes, they are already in the merchant's wallet. The kit exists for the one address class where the answer needs engineering: per-payment forwarder contracts.

Why forwarder addresses are the case that matters

On Bitcoin-family chains, payment addresses derive from your extended public key, so your own wallet software already knows them: nothing to recover. On account-and-reference chains, customers pay your own account directly: nothing to recover. Account-based contract chains like Ethereum, TRON, and Solana are different. There, each payment gets its own small forwarding contract, deterministically derived from the merchant's identity, the payment, and the treasury destination. Those addresses are safe by construction, the contract can only pay your wallet, but they are not addresses your wallet software knows about. If a payment landed at a forwarder and the sweep had not run when the platform went dark, you need the same derivation the platform used to find the address and move the funds. That derivation is what the kit preserves.

What is inside the kit

NoHoldPay's version is a JSON bundle plus a standalone command-line tool. The bundle records the derivation inputs for every treasury version you have ever registered: the identifiers and salts that, combined with the public derivation algorithm, reproduce each forwarder address exactly. The tool takes the bundle, re-derives the address space offline, checks balances directly against public chain nodes, and builds the sweep transactions that move anything it finds to your treasury, signed by your keys, paid with your gas. No NoHoldPay server appears anywhere in that sentence, which is the entire design goal. The same derivation code runs in the platform and in the tool, pinned by tests, so the two cannot drift apart.

What a recovery kit does not do

Scope honesty, because recovery is a word that attracts overclaims. A kit does not recover lost wallets: if you lose your own keys, no gateway artifact brings them back, and your own backups remain your responsibility. It does not recover funds sent to wrong addresses on wrong chains, which is a different problem with chain-specific answers. And it has nothing to do for funds that already settled to your wallets, which is most of them. Its one job is making the forwarder address class as platform-independent as the rest, and a merchant evaluating any non-custodial gateway should ask specifically about that class: how do I re-derive per-payment addresses without you?

Questions to ask any gateway about recovery

Four, in rising order of seriousness. Can I download the recovery material now, before anything goes wrong, rather than requesting it in a crisis? Does the recovery path work fully offline, or does it call your API? Does it cover every address I have ever been assigned, including old treasury configurations, or only current ones? And is the derivation code the recovery tool uses the same code the platform uses, or a reimplementation that can drift? A gateway with good answers has engineered for its own absence, which is the highest standard a non-custodial claim can meet. A gateway without answers is asking you to bet your forwarder funds on its uptime and longevity.

Common questions

Do I need a recovery kit if my gateway is custodial?: Recovery kits are a non-custodial concept: they preserve your independent access to addresses derived on your behalf. A custodial platform holds your funds in its own wallets, so there is nothing for you to re-derive, and your protection questions are different ones about solvency, regulation, and withdrawal terms.
When should I download and refresh the kit?: Download it as part of onboarding, before any payment needs it, and refresh it when the platform tells you the derivation scope changed, typically after registering a new treasury or wallet configuration. A stale kit still recovers everything it describes. It just may not know about addresses created after it was generated.
Can someone who steals my recovery kit take my funds?: The kit contains derivation inputs, not private keys, so a thief can compute your forwarder addresses but cannot spend from them: forwarders only pay your treasury, and sweeps are signed with keys the kit never held. Treat it as sensitive anyway, since it maps your payment history, but it is not a wallet backup.
Has self-recovery ever actually been needed?: The honest answer for most gateways including this one is that the kit is insurance, engineered and tested rather than battle-worn. The test that matters is reproducibility: the derivation is pinned by automated parity tests between platform and tool, so recovery does not depend on anyone remembering how anything worked.

The kit is part of how the non-custodial model keeps its promise with the platform absent. For the address mechanics the kit re-derives, see what a non-custodial gateway is.