Client overview
IntellectEU provides infrastructure, operations, and custom development solutions for regulated financial institutions moving onto blockchain networks. Its CatalyX Product Suite covers the infrastructure and operations layer for the Canton Network, including validator and Super Validator infrastructure, key management, and Daml application distribution. IntellectEU is a Premier Member of the Canton Foundation, a founding member of the Canton Network, and operates a Super Validator on the network, giving it a central role in how regulated institutions access Canton's privacy-enabled ledger.
Security challenges faced
As a founding member of the Canton Foundation operating validator infrastructure for regulated financial institutions, IntellectEU needed independent assurance that its Azure KMS driver, the component holding participants' signing keys, could stand up to institutional scrutiny.
The driver's risk surface extended beyond the code itself into how it integrated with Canton's KMS driver contract, cloud configuration, and the build pipeline, requiring a review that spanned multiple layers rather than a single audit track.
Because customers retain control of their own signing keys under IntellectEU's architecture, the company needed to validate that its key handling and audit logging practices matched that trust model in practice, not only in design.
Halborn's solutions
Code Security Audit: a manual review of the Scala-based Azure KMS driver, examining permission scoping, runtime loading behavior, and the build pipeline supporting it.
Custody & Key Management Advisory: an assessment of how signing keys are operated day to day, covering audit logging defaults and the traceability of signing activity back to the originating node.
Blockchain Architecture Advisory: a benchmark of IntellectEU's Azure driver against Canton's existing AWS and GCP KMS drivers, assessing consistency with the network's established design patterns.
Assets and technologies assessed
- Scala-based Azure KMS driver codebase
- Integration layer with Canton's KMS driver contract
- Cloud configuration and access permissions surrounding key operations
- CI/CD build pipeline and dependency management
- Audit logging and signing-activity traceability workflows
- Architecture documentation and threat model
Results achieved
Two key findings resolved: overly broad key permissions scoped down to role requirements, and a runtime driver-loading path secured against build pipeline compromise.
Audit logging enabled by default, with every key operation traceable to the node that performed it, giving IntellectEU's customers full visibility with no added configuration.
The build chain hardened end to end: the Canton base image pinned to a SHA-256 digest, driver integrity enforced through a boot-time checksum gate, and dependency scanning added as a standing CI control.
What set Halborn apart
Rather than evaluating the driver purely against secure coding standards, Halborn benchmarked it against Canton's existing AWS and GCP KMS drivers, testing whether it behaved consistently with the network's established norms rather than only whether it was safe in isolation. For a component institutions will rely on to control their own keys, that comparative lens gave IntellectEU a more useful answer than a standalone code review could have provided.
"There are a few common questions to ask before letting anyone run your validator. Where do the private keys physically live, and can you prove they never leave that boundary. What can the operator do with those keys that the client cannot see. And if the client wanted to revoke access tomorrow, could they do it themselves, without us. If those answers aren't clean, the operational convenience isn't worth it."
- Jonathan Mayeur, Head of Product at IntellectEU
Going above and beyond
More than a code review, Halborn's team followed IntellectEU's risk from the driver's logic into the cloud configuration around it and through to the build pipeline that ships it. That work extended past the original scope into hardening the CI pipeline itself: pinning the Canton base image to a SHA-256 digest, adding a boot-time checksum gate, and introducing dependency scanning as a standing control, changes that carry forward into every future release IntellectEU ships.
The engagement positioned IntellectEU to operate its Super Validator with defaults that already meet the transparency regulated institutions expect: audit logging on from the start, key activity traceable to its source, and a build chain that can prove what it shipped. That gives IntellectEU's engineering and compliance teams a shared, evidence-backed answer when institutional customers ask questions about where their keys live and who can touch them.
