Bitcoin in a multisig where I have a majority of the keys. E.g a 2 of 3 multisig with one key in the app, one key on your server, and one key, generated by the app, on a piece of paper. It means Bunq can never confiscate funds. In case of a dispute or bank failure, I retain access through the 3rd key. In case I lose my phone the coins can be redeemed after some delay with just 1 key.
* = never sent to the server