What no tool signing actually means
Non-custodial is easy to say and easy to fake. Here is the specific capability that has to be absent for the claim to be true, and how we check it stays absent.
Most tools that touch a blockchain say they are non-custodial. It is an easy thing to say and an easy thing to fake, because there is no obvious test for it. mintrr makes the claim in a form you can check: no tool signs. The maximum output of anything here is an unsigned transaction, and the signing happens on your side, with your key, where mintrr cannot see it.
That sentence is worth unpacking, because the difference between "we do not usually hold your keys" and "no tool can sign" is the difference between a policy and a property.
The property, stated exactly
There are three things a custodial tool can do that a non-custodial one must not.
It must not sign. It must not take a private key and produce a signed transaction. It must not return a secret. No key, no seed, no mnemonic comes back out of any endpoint, ever, in any response. And it must not broadcast on its own authority: sending a transaction needs a human who types a phrase, and an owner different from the account that pays gas.
The first two are properties of missing capability. It is not that the tool chooses not to sign; it is that no code path exists that signs. The third is a control: even for a transaction you built, broadcasting is a deliberate, typed act.
How we prove it stays true
A claim like this decays. Someone adds a convenience endpoint, or a helper that signs "just for local use", and the property is quietly gone. So it is tested, not trusted.
There is a test that fails if any tool in the agent surface declares a signing or broadcast capability. There is a lint that keeps the key-handling modules out of the service layer, so the web tier cannot reach them at all. And the deploy path itself only ever produces an unsigned transaction: you sign it, on your own wallet, and the signature never touches mintrr.
The point is not that we remembered to be careful. The point is that the build goes red if the property stops holding. A capability that is tested to be absent is a different thing from a promise that it is.
What this means when you use it
When mintrr builds you a token, it hands you a transaction you cannot yet send, because nobody has signed it. You open your wallet, you look at what it does, you sign. If you do not sign, nothing happens, and mintrr cannot make it happen. The key that moves your money is never in the same room as the code that describes it.
That also bounds what mintrr can do for you, and the bound is honest: we cannot recover a transaction you did not sign, cannot send for you when you are away, and cannot hold an asset on your behalf. Every one of those is a feature of the custody model, not a gap in it. A tool that could do them could also, one bad day, do them without you.
The limit
Not signing is a strong property, and it is not the whole of security. A contract can still have a bug; a key you hold can still be stolen from your own device; an address you paste can still be wrong. mintrr closes the custody gap and proves the claims it makes about the code. The rest is yours, and we say so rather than implying the product covers it.
If "nobody but me can move my money" is the property you need, that is exactly what is built here. Reach out from the contact page and we will walk through the flow that keeps the key on your side.