> For the complete documentation index, see [llms.txt](https://docs.husher.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.husher.io/documentation/how-husher-works/how-it-works/role-separation-and-custody-boundaries.md).

# Role Separation and Custody Boundaries

The four parties in every Husher swap, what each one controls, and where custody boundaries sit

Every Husher swap involves four distinct parties. Their roles are strictly separated, and no party holds authority or custody beyond its defined scope.

| Party                                 | Role                                                                                                                                                                                | Custody of funds                                                                                                                            |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **User**                              | Chooses assets, amount, mode, and destination wallet(s). Sends funds from a self-custodied wallet. Retains full control of private keys.                                            | Full custody before and after the swap. Funds leave the user's wallet only when the user initiates the send.                                |
| **Husher**                            | Provides interface and routing logic. Monitors confirmations and execution conditions.                                                                                              | None. Husher never holds, receives, or redirects funds.                                                                                     |
| **Exchange Service Providers (ESPs)** | Temporarily receive funds during execution. Execute trades against CEX liquidity. May route across one or multiple centralized exchanges. Withdraw output directly to user wallets. | Temporary custody during active execution only. Funds are deposited to ESP-generated one-time addresses and immediately used for the trade. |
| **Centralized exchanges (CEXs)**      | Provide spot-market liquidity for the executing ESP.                                                                                                                                | None with respect to end users. CEXs have no relationship with Husher users.                                                                |

{% hint style="info" %}
The separation between Husher and the ESPs is structural. Husher cannot instruct an ESP to redirect funds, freeze an order, or alter the destination. Once a deposit is sent, execution follows the rules set at order creation.
{% endhint %}

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Explicit Non-Custodial Guarantees</strong></td><td>The five guarantees that confirm Husher never touches your funds.</td><td><a href="/documentation/how-husher-works/how-it-works/explicit-non-custodial-guarantees.md">Explicit Non-Custodial Guarantees</a></td></tr><tr><td><strong>ESP Role in Security</strong></td><td>How Exchange Service Providers are used and what they are responsible for.</td><td><a href="/documentation/security/security/exchange-service-providers-esp-role.md">Exchange Service Providers (ESP Role)</a></td></tr></tbody></table>