Wallet policy, 2026-11-04

The owner's decision on which wallet customers use at launch.

Question	Decision	What it means
Which wallet do customers use?	The Dara wallet only	Customers buy, sell, transfer and see GOLD in `apps/wallet`. Dara holds the keys (custodial)
Can a customer move GOLD to an outside wallet?	No, not at launch	This keeps Q-09 in place. Transfers go only between Dara customers
What are global wallets and explorers for?	Viewing only	Once the home domain and `stellar.toml` are live, wallets and explorers can identify GOLD. They cannot hold it, because `AUTH_REQUIRED` holds a trustline at zero until Dara authorizes it

Nothing in the platform changes: the closed holder set (INV-02) and the indexer's CRITICAL incident for an unknown holder stay as they are.

Not decided

Self-custody later. Letting customers withdraw GOLD needs its own decision. It would need KYC-linked authorization of the outside account, changes to the closed-holder-set checks, withdrawal limits, customer terms covering freeze and clawback, and a legal opinion on sanctions, since wallet providers may restrict users or assets connected to Iran.
A hardware key for the human signer. Moving the signer's key from the laptop to a hardware wallet is recommended before the Mainnet canary. The owner decision on 2026-10-31 (a software key on a laptop) stands until the owner changes it. ../security/KEY_MANAGEMENT.md describes both.