Coming soon. The clearing layer is in design. This page states the privacy and control model it is being built to - each claim here is a design requirement, not a launch announcement.
Nobody Sees Your Book
Your book is your edge, and a netting engine needs to read the whole graph. Both stay true:- The only place positions are ever readable is a sealed engine - attested hardware whose exact program is verifiable on-chain. Decryption happens there and nowhere else.
- You see your own slice. Every member holds the same encrypted records; only yours open under your key. Your edges, your net number - nobody else’s.
- Netting is itself a privacy technology. A debt that nets never moves on any chain: the matched majority of flow leaves no on-chain trace at all, and the chain checks one proof per run, not one position.
- A broken seal could leak - it could never forge. Correctness does not depend on the hardware: every run’s result passes an on-chain validity proof, so even a compromised engine cannot move a dollar or invent a debt. The honest statement of the trust model: no decryption mechanism exists outside the attested enclaves, the code that can hold keys is governed on-chain and reproducible by outsiders, and independent operators join the key federation on a published schedule.
Who Sees What
Who You End Up Facing
Netting has a reputation for changing who you face. This one cannot:- Your counterparty never changes. A clearing house would step into every trade and become your counterparty - that is novation, and it never happens here. Your accepted trade stays yours, and money forwards only along edges that already exist.
- The perimeter guarantee. You only ever face firms your policy approved, and netting never expands that set. Nobody outside your perimeter ever receives value from you.
- Compliance can exclude, never redirect. A rule can mask a pairing out of a run; it can never map money somewhere new, and a blocked pairing never becomes anyone’s claim on you.
- A default hits the pair, never the pool. There is no default fund and no mutualized loss: you can only ever lose your own position with the defaulter.
The Lines That Never Move
- No clearing house. Debts are extinguished by set-off between the parties that signed them - never novated onto a middleman.
- No pooled custody. Funds move wallet to wallet on rails you already use; the protocol never holds them.
- No locked capital. No margin, no pre-funding; your wallet is untouched until the pull window opens.
- No trust-us phase. Value flows only when the full stack is live: the proof verified on-chain, the engine attested, replicas running, and a member recovery drill demonstrated. Until then: test networks and shadow runs only.
- No edit path. Obligations are write-once; corrections are signed offsetting entries, and nobody - operator included - can alter what you signed.
Keep Going
How It Works
The clearing run step by step, funding, and where the residual goes.
Where It Applies
One clearing layer, many kinds of debt - and why every new lane raises everyone’s ratio.