# Accounts and custody Here is the part that surprises people: the address you already use on Base or Ethereum is already a Kakushi account. There is nothing to deploy and nothing to enroll. A zone account is just an address, the one a key signs as, and it becomes an account the moment that key signs to claim a receiving address. The account itself comes to life when the first deposit lands.  Because the address is the account and nothing gets deployed, you bring whatever you already have: an existing EOA, a treasury signer, a user's wallet. One thing to keep straight: your zone balance and your host-chain balance are separate. Using an address in a zone does not move or reveal what it holds on the host chain. Same address, same key, two ledgers. Custody is then a single question, and it is not about the protocol. It is about where you keep the key. * **Custodial.** You hold the account's key in your own secret store, and wrap it as a viem account to pass to the SDK to sign. Nothing is required of the end user. * **Non-custodial.** The user holds the key in a wallet you do not control. They sign in their own client. You never see the key and cannot move their money. The SDK never holds keys. It signs with whatever account you hand it, which is why custodial and non-custodial are the same code path with the key in a different place. Here is how you get that account in each case. Custodial, server-side: load the key from your own secret store and wrap it as a viem account. The SDK only ever sees the account. ```ts import { privateKeyToAccount } from "viem/accounts"; // load the key from your own secret store / env; the SDK never sees the raw key const aliceAccount = privateKeyToAccount(process.env.ALICE_PRIVATE_KEY as `0x${string}`); ``` Sandbox: a throwaway account. ```ts import { generatePrivateKey, privateKeyToAccount } from "viem/accounts"; const aliceAccount = privateKeyToAccount(generatePrivateKey()); ``` Non-custodial, browser: the account comes from the user's wallet and the key stays on their device, but it is still a viem account. ```ts import { toViemAccount } from "@privy-io/react-auth"; const account = await toViemAccount(embeddedWallet); ``` :::note This is a V1 statement. A V1 account is a single key. Multiple owners, thresholds, and passkeys need a smart account, a contract at the address with its own validation logic, which is a V2 capability. :::