Three modes, one rule
The wallet runs in the mode you choose. EMBEDDED keeps an encrypted vault on your own device, in your browser's storage — the keys are generated there and never leave. HARDWARE connects an external wallet or hardware signer you already own. WATCH-ONLY holds just a public address for viewing, with signing done on a separate, air-gapped device via QR codes. In every mode the rule is identical: signing happens on your hardware, under your hand.
What the server can and cannot do
The Republic's servers relay transactions; they never author them. The RPC proxy the app uses accepts only an allow-list of read methods and the broadcasting of transactions ALREADY SIGNED by you — a request asking the server to sign or send on its own authority is rejected by design. The server stores public data only: addresses, signatures, hashes. There is no key ceremony, no recovery desk, and no admin who can move your funds, because there is nothing on the Republic's side capable of it.
What this asks of you
Sovereignty has a price: your seed phrase is yours alone, and the Republic cannot reset it. Write it down, keep it offline, and treat any person or page asking for it as an attacker — no organ of the Republic will ever ask. The Charter of Rights makes self-custody a right; this wallet makes it the default.