System Architecture

Tapin Wallet is a native application, compiling to a real Android app and a desktop build from the same codebase. Its interface is rendered through an embedded browser view, but everything security critical, key management, signing, and encryption, runs entirely in the native layer underneath it, never in the interface code itself.

A bridge connects that interface to the native layer, and every call across it passes through the same enforcement before anything happens: is the vault unlocked, and does the calling module actually have permission to do this. Nothing skips that check.

Security Model

The vault protects every secret with envelope encryption. A random encryption key protects the vault's contents, and that key is itself wrapped under a key derived from the user's PIN or password using an industry-standard key derivation function tuned to OWASP's recommended strength. Individual secrets are encrypted at rest with authenticated encryption, so a wrong PIN simply fails to decrypt rather than being checked against a separate password test that could be bypassed.

Each installed module gets its own storage key, derived from the vault's key but cryptographically independent of it and of every other module's key. A compromise of one module's data reveals nothing about the vault, the user's identity key, or any other module. The vault also locks automatically after a period of inactivity, and once locked, every operation that needs it is blocked until the user unlocks it again.

Identity and Trust

When a wallet is created, it generates its own signing keypair on the device. The public key is registered with Bitcrumb, which assigns a decentralized identifier tied to it. From that point on, any party can ask Bitcrumb to confirm that identifier is genuinely bound to that public key, without Bitcrumb ever holding, seeing, or being able to use the private key itself.

Signing happens entirely inside the native layer. A module can ask the wallet to sign something on its behalf, but it only ever receives the resulting signature, never the key that produced it. Session credentials work the same way: the wallet proves ongoing presence with short-lived, self-issued tokens instead of checking in with a server for every action.

The Module System

Wallet functionality is delivered as modules: small, self-contained bundles of interface code that run inside the wallet's own sandbox. Each module declares exactly what it needs, identity access, storage, signing, and the wallet only grants what was declared and what the user accepted at install time.

Third-party modules carry a developer signature that the wallet verifies before installing them and again every time the wallet starts, so tampering with a module after installation is caught rather than silently trusted. Built-in modules cover the wallet's core experience: a vault for records and contacts, XRP Ledger payments, and a marketplace for tokenized digital assets.

XRP Ledger Integration

Tapin Wallet implements its XRP Ledger support natively, from key generation and address derivation through transaction signing and submission, without depending on an external XRPL library. It supports payments, RLUSD and other issued currencies through trust lines, and on-chain escrow.

Escrow uses the ledger's own conditional-release mechanism with a third-party arbitrator: funds lock on-chain until a cryptographic condition is met, the arbitrator releases the condition once the agreed terms are satisfied, and the relay carrying that exchange never has access to the underlying secret at any point.

Selective Disclosure

Tapin Wallet can hold tokenized records built on Bitcrumb's schema system: structured data where each field is committed to with a salted hash. A single field, like a verified name or a credential, can be shared and checked against that commitment without exposing the rest of the record.

A peer receiving a disclosed field can confirm it genuinely came from the claimed identity's record, but learns nothing about any other field in that record. This is the same mechanism the wallet uses to let two people verify facts about each other during a handshake, before either side shares anything else.

The CRUMB Token

CRUMB, Bitcrumb's native token, is mined by real events and activity across the network rather than issued on a schedule or handed out centrally. It is tradeable, and its value is whatever the market attaches to it, not something set centrally. The wallet exposes CRUMB balances and transfers directly, and surfaces an identity's broader activity history as a trust signal in peer-to-peer contexts.

Where Things Stand

The identity, vault, module, and XRP Ledger layers described here are real and running in the current build. Tapin Wallet is still evolving: richer credential presentation, biometric unlock, and direct wallet-to-wallet asset transfer are active areas of work, not finished features.

Tapin Wallet's bet is that a mobile wallet should not have to choose between security and extensibility. Every key stays on the device, every module runs inside its own boundary, and every extension only ever gets what its user actually agreed to give it.