# Signing profiles

A signing profile holds the keys you sign with in a workspace. Vaults reference your profile's public keys to identify you as a signer. Your private keys stay on your device, on your hardware wallet, or in your HSM.

> Part of the SQRL documentation, section "SQRL Enterprise".
> Rendered page: https://docs.sqrl.tech/enterprise/signing-profile

## How signing works

When a movement or asset action needs your signature, SQRL Enterprise presents the transaction for you to review. You approve it with your software key, your Trezor or your HSM, and the signature is added to the transaction. SQRL stores your public keys only and never sees a private key.

## Three ways to hold a key

* **Software signing profile.** SQRL Enterprise creates your key in your browser and keeps it there, encrypted under your wallet password. It never leaves the device. Your recovery phrase is the only backup.
* **Hardware wallet (Trezor).** Your key stays on the device, which shows what you are approving on its own screen.
* **HSM.** The Signing Profile offers an HSM-backed signing option for issuer admin keys, so asset administration never depends on a person's laptop. Your SQRL account team sets it up with your key-ceremony process.

You can hold several signing profiles in a workspace, for example one for treasury vaults and one for an issuance vault.

  SQRL stores public keys, xpubs and fingerprints only. If you lose a software profile's recovery phrase and the browser that holds it, SQRL cannot recover the key.

## Signing profiles and vaults

Your signing profile is personal: it identifies you as a signer. A vault is organisational: it holds assets and enforces how many signers must approve. When a vault is created, the creator selects signers' keys from their signing profiles.

Continue to [Setting up a signing profile](/enterprise/signing-profile/setting-up-your-signing-profile).