Production readiness

One checklist for the Protocol, the SDK and the Bloxchain Platform before an account holds value you cannot afford to lose.

You need: a Sepolia account you have already configured and operated

Where things stand

Surface	Status today
Bloxchain Protocol (contracts, SDK)	Core framework audited (Nethermind NM_0828). Official deployments on Sepolia. Ethereum mainnet deployments coming soon.
Bloxchain Platform (bloxchain.app)	Alpha · Testnet · Local-first. Sepolia only. Free on this device; sign in if you have early access, otherwise join the waitlist; organizations available as paid plans. Not for real value during alpha.
Your extensions	Custom contracts, custom factories and proxies are outside the audit scope. Review them separately.

Enforcement is always on chain. The Platform and the SDK are clients; neither can loosen a rule stored in the account. Audit scope and reports: Audit status.

Checklist

1. Versions and deployment

• Accounts come from a tagged Protocol release or the official factory, not an unreviewed fork.
• @bloxchain/sdk and @bloxchain/contracts are pinned to the same release. See Releases and compatibility.
• The account address and chain are verified on a block explorer.
• You know whether each account is an immutable clone or a custom proxy. See Immutable vs upgradeable.

2. Policy on chain

• Every function your team will call is registered as an action. See Actions.
• Roles exist for each duty, signers are assigned, and per-step permissions are set with Manage permissions. No action shows Flow incomplete. See Roles and Manage permissions.
• Every granted role has its gate. Remember gates are permanent for that role. See Gates.
• Allowlists (recipients, payees, allowed contracts) contain only what is needed. An empty list allows nothing. See Allowlists.
• Owner, Recovery and Broadcaster addresses are distinct, documented offline, and none is used as a day-to-day operator key. The time lock gives a human time to notice and cancel. See Security.
• Separation of duties holds: no single wallet can request and approve a critical action unless you decided that on purpose. See Design roles and permissions.

3. Platform workspace

• The connected wallet is on the same network as the account. See Connect a wallet.
• The account list on this device is exported from Settings → Backup, and everyone who operates knows Bloxchain keeps no copy. See Backup and restore.
• If you use an organization, checkout is complete (Organization active, not Checkout required) and member addresses are current. See Organizations and billing.
• Operators have practised New request, Approvals and History. See Operate an account.
• You know how signed files move between devices and who may submit them. The optional Bloxchain broadcaster relay needs sign-in and is not promised in every environment; a wallet with the Broadcaster role can always submit. See Signed files.

4. Rehearsed on testnet

• Each execution path your policy enables (Delayed release, Signed approval, One signature) has run end to end on Sepolia.
• A cancel during the time lock has been tested.
• Revert reasons for a denied request are understood. See Troubleshooting.

5. Security and legal

• Security model and Known limitations read.
• Custom contract code reviewed separately from the Protocol audit.
• Legal and compliance review done for your jurisdiction. See Disclaimers.
• The team knows how to report a vulnerability privately.

Recovery planning

Write this down before you need it. The operator-side procedure is in Recovery and incidents; these are the integration points.

• Record which addresses hold Owner, Broadcaster and Recovery for each account, and where those keys are stored.
• The SDK's account address is the smart account, not your business-logic contract. Document both, and which actions and allowlist entries connect them.
• Record whether each account is an immutable clone or a custom upgradeable proxy, and who holds any proxy admin key.
• Plan a migration: for immutable accounts, new logic means a new account, a policy rebuild, governed asset moves and updated allowlists and integrators. See Recovery and incidents → Limits.
• Know how to invalidate a leaked signature: consume the signer's nonce, rotate the signer off its role, or wait for the deadline. See Meta-transactions.
• Rehearse the recovery path on a disposable Sepolia account, and repeat it whenever key holders change.

When something goes wrong

• Operators: Troubleshooting and the in-app Help page.
• Security issues: Report a vulnerability.
• Everything else: Support and community.

Related

• Deploy the Protocol
• Audit status
• Security best practices
• Roadmap