Runevault

dashboard
login screen
generated glyphs
example receipt
inside the token

Inspiration

In most companies, sending a large payment can be incredibly risky when only a username and password stand in the way. One shared login or compromised account can lead to a costly transfer that's hard to undo. Approving a six-figure payment often takes just one click.

We wanted every high-value payment to be approved on purpose, by the right people, with something you can hold that doesn't need the internet to sign.

We drew inspiration from the Poneglyphs in One Piece: ancient stone tablets that guard secrets only the right reader can unlock. Runevault is a security key disguised as one of those relics. Every important transfer must be sealed by hand before it sets sail.

What it does

📜 Physical sign-off: When an employee requests a transfer, Runevault generates a random, one-time glyph sequence that expires after two minutes. The requester enters it on the Runevault tablet, with lights confirming each step, and the tablet signs that exact transfer (amount, destination, glyphs and a counter). The tablet itself has no network connection.

🔐 Verification: The backend checks that the signature is genuine, matches the stored transfer, comes from the registered tablet, and has never been used before. Too many wrong glyph sequences lock the tablet, and an admin can revoke a device entirely.

🧭 AI risk review: Gemini turns the glyphs into ancient lore and returns a risk score with a plain-English explanation, based on the transfer details and risk signals our server calculates, such as whether the recipient has been paid before and how the amount compares to past payments. Gemini advises while our backend rules make the final call. If Gemini fails, times out or answers badly, the transfer is blocked. High-risk transfers are flagged and sent to the CFO for review.

👑 Two-person approval: A CFO must release each verified transfer, and no one can approve their own request, even with the CFO role.

⚓ Secure transfers: Only after every check passes does Runevault claim the transfer exactly once and send it through Capital One's Nessie sandbox API, then show a receipt. Pending transfers are re-checked automatically, but nothing is ever resent automatically.

🛡️ Role-based access: Employees create and track their own requests. CFOs release other people's transfers. Auditors get a read-only company audit log. Administrators can revoke devices and recover stuck transfers. Every permission is enforced on the backend.

🗺️ Live captain's log: The dashboard updates in real time with status, risk gauges, lore, receipts and an approvals-vs-blocks chart. An "Explain decision" button asks Gemini to explain the recorded result in plain English, without ever being able to change it.

How we built it

Frontend: Our dashboard uses Angular and TypeScript, styled with weathered stone, parchment and ocean tones in a navy and gold palette.

Hardware: The physical key is a Raspberry Pi Pico 2 running MicroPython. It signs each transfer with HMAC-SHA256 and saves a counter to block replays. Approvals reach our backend over USB, either through a Python bridge or directly from the dashboard using Web Serial.

Backend: Our Java and Spring Boot backend runs every transfer through one pipeline:

1 · Verify the signature, device, counter, and rate limits.

2 · Review by sending only transfer metadata and server-calculated risk signals to Gemini, which returns schema-enforced JSON.

3 · Decide by applying our rules (confidence of at least 0.8 and risk of at most 30), then routing the transfer to a CFO for sign-off.

4 · Execute by claiming the transfer once under a database lock, calling Nessie, and building the receipt.

5 · Broadcast each step live over Spring WebSockets and record it in Tiger Data (TimescaleDB) for live charts.

Infrastructure: Login and roles are handled by Auth0. Everything runs in Docker on a Vultr server behind Caddy, at our GoDaddy Registry domain, sailthedeal.fishing.

Challenges we ran into

Some of our components, including push buttons, were faulty, so we had to test each part to tell a dead button from loose wiring or a firmware bug.

The tablet and backend had to produce identical signatures down to the byte, and tiny formatting differences broke valid approvals until we wrote a shared signing spec.

We started with two approval flows and merged them into one, so no transfer can skip a check. We also had to keep Gemini helpful without letting it make security decisions.

Accomplishments that we're proud of

Runevault works end to end, even though we feared we'd never get the hardware and software to talk to each other, especially with broken parts in the mix. A button press on the tablet travels over USB, gets verified, is reviewed by Gemini, is released by a CFO, goes through Nessie, and shows up live on the dashboard.

Every failure is a safe one. Transfers are blocked if Gemini doesn't respond, glyph sequences expire, and bad signatures, replays, high risk, self-approval and AI outages are all stopped, never leading to an accidental payment.

Our biggest accomplishment was turning payment approval into something that feels like uncovering an ancient artifact, and trying something that isn't purely software. We were really glad to see how much safer authentication can be when it's physical and doesn't rely on WiFi.

What we learned

Hardware security: signatures, counters, replay protection, and how strict byte-level protocols are.

Hardware debugging: isolating faulty components from code bugs, and building simulators so software work doesn't wait on hardware.

Responsible AI: getting reliable JSON from Gemini, and letting AI advise rather than decide.

Identity and access: building role-based access and two-person approval with Auth0, enforced on the backend.

Time-series data: using TimescaleDB hypertables and aggregates for live charts.

Cloud deployment: going from localhost to a live HTTPS domain on Vultr.

What's next for Runevault

Tiered and multi-step approvals: approval limits per role (for example Department Heads up to $10,000, the CFO up to $250,000, and the CEO any amount), and big transfers that need both a Department Head and the CFO. Runevault's single pipeline and server-enforced roles are built to grow into this.

More custom glyphs: more combinations than our current three glyphs, and more stories for Gemini to tell.

Banking integrations: bringing the physical seal to real corporate banking platforms.

Hardware prototype: a compact, lightweight Runevault token that's easy to carry, with sturdier buttons.