# Manage vaults and wallets

A vault is a permanent container for on-chain wallets, wallet security groups, and one Signing Policy. Use the **Vaults** workspace to manage all three in one place.

## Create a vault

You need **Create Vaults** permission.

1. In the sidebar, select **Vaults**.
2. Select **Create New Vault**.
3. Enter a vault name and an optional description.
4. Select **Create Vault**.

The Crypto Vault derives a stable vault ID from the name. Vaults cannot be deleted after creation, so confirm that you want the container before you create it. You can edit its display name and description later.

The Vaults page lets you search by name, filter by status, select multiple vaults, and freeze or unfreeze them in bulk.

## Work in a vault

Select a vault to open its detail page. The summary shows its status, wallet count, and creation date. Three tabs organize its resources:

| Tab | Purpose |
|---|---|
| **Wallets** | Generate, search, filter, edit, freeze, unfreeze, or delete wallets |
| **Security Groups** | Group wallets for use as the source condition in this vault's Signing Policy |
| **Signing Policy** | Review and edit the rules that gate signing from this vault |

You can also select **Open in Signing Policy** from the Signing Policy tab to use the full policy editor.

## Generate a wallet

You need **Create & Manage Wallets/Keys** permission for the vault.

1. Open the vault's **Wallets** tab.
2. Select **Generate Wallet**.
3. Enter a name and optional description.
4. Select a network family.
5. Select one or more available networks in that family.
6. Select **Generate Wallet**.

The available families, networks, and testnet labels come from the Crypto Vault. If an administrator disables testnets in [System Settings](/guide/system-settings/configure), testnet choices are unavailable for new wallets.

An EVM wallet has one address that can be enabled on multiple EVM networks. The network family is fixed after generation, but you can edit the wallet's display name, description, and selected networks.

:::warning
The app warns when a wallet includes both mainnet and testnet networks. Review the selection carefully before generating or saving it.
:::

## Organize wallet security groups

Security groups let one Signing Policy rule cover a selected set of wallets.

1. Open the vault's **Security Groups** tab.
2. Select **New Security Group**.
3. Enter a name and optional description.
4. Select the wallets to include.
5. Create the group.

You can search groups, filter them by member wallet, and edit group membership later. Deleting a security group removes the grouping only. It does not delete its wallets.

Security group management follows the vault scope assigned under **Manage Signing Policies & Security Groups** in Administrative Policy.

## Freeze or unfreeze

Freezing a vault blocks signing from every wallet it contains. Freezing one wallet blocks only that address.

* From the Vaults page, freeze one, several, or all vaults.
* From a vault's Wallets tab, freeze one or several wallets.
* Confirm the action by typing the phrase shown in the dialog.

Use **Freeze Assets** to control who can freeze and **Unfreeze Assets** to control who can restore access. A frozen vault continues to exist with its wallets, groups, and policy intact.

## Delete a wallet

You can delete one or several wallets from the Wallets tab if you have permission to manage wallets for that vault. Deletion is permanent. Confirm that the address is no longer needed and is not referenced by an external system before deleting it.