> For the complete documentation index, see [llms.txt](https://docs.husher.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.husher.io/documentation/how-husher-works/how-it-works/explicit-non-custodial-guarantees.md).

# Explicit Non-Custodial Guarantees

The five structural guarantees that confirm Husher never holds, redirects, or controls user funds

Husher's non-custodial design is structural, not a policy choice. The following guarantees apply to every swap on the platform, regardless of order type or trade size. The one exception is Batch & Collect's optional Automatic Mode, where you choose to share private keys so Husher can collect from your wallets on your behalf; see [Key Ownership](/documentation/security/security/key-ownership.md) for how that opt-in flow differs.

{% hint style="success" %}
These guarantees are enforced by architecture. They are not dependent on Husher's behavior as a company.
{% endhint %}

### The five guarantees

1. **Funds never pass through Husher-controlled addresses.** Deposits go to ESP-generated one-time addresses, not to any address Husher owns or controls.
2. **No internal balances or user accounts are created.** Husher does not hold assets on behalf of users between swaps or at any other time.
3. **Deposits go directly to ESP-generated addresses.** The routing layer requests these addresses from the ESP; it does not create or control them.
4. **Outputs are withdrawn directly to user wallets.** The output asset is delivered to the destination address specified at order creation, with no intermediate Husher hop.
5. **Husher cannot freeze, reverse, or redirect funds.** Once a deposit is sent, execution follows the rules set at order creation. Husher has no mechanism to alter this.

{% hint style="info" %}
Because of this separation, Husher cannot seize or misuse assets, even in worst-case scenarios.
{% endhint %}

{% hint style="warning" %}
Non-custodial design also means Husher cannot recover funds sent to the wrong address, sent on the wrong network, or sent after a Fixed-rate lock expires. Verify all details before sending.
{% endhint %}