Collaborative Custody is a custody model in which the owner and another party participate in administration and signing. In a typical Bitcoin multisig arrangement, the service holds a minority key and helps with recovery. The name alone does not prove that the owner holds enough keys to spend independently.
Unchained describes its collaborative vaults as 2-of-3: the client holds two keys and the service one. In a model labeling client keys A/B and the service key C, A+B, A+C or B+C therefore suffice; C alone does not. This is one arrangement, not a property of every similarly named product. Two devices with the same seed do not provide two independent protections against risk: compromising the shared seed affects both. [Unchained — Collaborative custody vaults] [Bitcoin Core — Output Descriptors]
The coordinator assembles policy and transaction material; the signer controls a private key. BIP 174 uses PSBT to exchange information and partial signatures between roles. Merely creating a PSBT does not supply a missing signature. A malicious interface can still propose an incorrect recipient or change output and try to obtain valid approval. Verify the meaning of the transaction being signed, not merely the number of connected devices. [BIP 129 — Bitcoin Secure Multisig Setup] [BIP 174 — Partially Signed Bitcoin Transaction Format]
BIP 129 describes secure exchange of key and descriptor records: participants should compare the policy and first address. Check quorum, key membership, script type and derivation paths; a substituted configuration can redirect deposits. BIP 129 itself does not cover tamper resistance of device storage or subsequent receive and change address verification. Format support therefore does not prove that the entire signing device is secure. [BIP 129 — Bitcoin Secure Multisig Setup]
Recovering a conventional 2-of-3 also needs the public keys of all three participants, including the provider, and the precise script and derivation description. An Output Descriptor or compatible configuration file preserves that map; two personal seeds may not recreate the third party’s missing public key. Save and verify the export while the service is available. A descriptor can also contain private keys, so inspect the export’s contents before sharing it. [Bitcoin Core — Output Descriptors] [Unchained — Wallet configuration and recovery]
With working A+B and the configuration, this model permits acting without C. If only A remains, A+C needs an available, willing service; an outage or refusal to sign may then block recovery. Losing both A and B leaves C insufficient. Casa explicitly assumes its recovery key is unavailable when recovering without its infrastructure. This implies treating independent spending and assisted recovery as two separate scenarios. [Unchained — Collaborative custody vaults] [Casa — Recovery without Casa]
Public configuration and an xpub can reveal derived addresses and their transactions even though they do not sign. A provider that knows them may see activity; links to identity also depend on its accounts and records. Evaluate the ability to spend separately from the ability to observe. “The service cannot spend alone” applies only to the described keys and policy, not after acquiring another client key or deceiving a signer. [BIP 129 — Bitcoin Secure Multisig Setup] [Bitcoin Core — Output Descriptors]
For an ordinary multisig output, renaming a key in an app does not rewrite the blockchain script. Retiring a lost or compromised key requires a new policy and a confirmed transfer of the relevant UTXOs. Then check what remains at old addresses and update configuration and heirs’ instructions. Removing account access does not itself revoke a valid signing key; family handover must be assessed using the actual combinations. [Bitcoin Core — Output Descriptors]
On a separate test wallet, verify importing saved configuration into a compatible tool, matching addresses and signing with your own quorum without the service. Caravan is an open-source coordinator; check specific device and format support. A watch-only import proves wallet discovery, not signing ability. Testing should also include assisted recovery, fees, change and an unavailable key. Record the version and outcome rather than relying on a marketing promise of recoverability. [BIP 174 — Partially Signed Bitcoin Transaction Format] [Casa — Recovery without Casa] [Caravan — Open-source coordinator]
For the clearest picture, read this entry together with Multisig, Self-custody, Output Descriptor, PSBT, Bitcoin Inheritance Plan, Counterparty risk. The reverse links also lead from Bitcoin Inheritance Plan, Institutional bitcoin custody.