> ## Documentation Index
> Fetch the complete documentation index at: https://tetrafi.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy & Control

> Who sees what, who you end up facing, and the lines the protocol never crosses.

<Note>
  **Coming soon.** The clearing layer is in design. This page states the privacy and control model it is being built to - each claim here is a design requirement, not a launch announcement.
</Note>

## Nobody Sees Your Book

Your book is your edge, and a netting engine needs to read the whole graph. Both stay true:

* **The only place positions are ever readable is a sealed engine** - attested hardware whose exact program is verifiable on-chain. Decryption happens there and nowhere else.
* **You see your own slice.** Every member holds the same encrypted records; only yours open under your key. Your edges, your net number - nobody else's.
* **Netting is itself a privacy technology.** A debt that nets never moves on any chain: the matched majority of flow leaves no on-chain trace at all, and the chain checks one proof per run, not one position.
* **A broken seal could leak - it could never forge.** Correctness does not depend on the hardware: every run's result passes an on-chain validity proof, so even a compromised engine cannot move a dollar or invent a debt. The honest statement of the trust model: no decryption mechanism exists outside the attested enclaves, the code that can hold keys is governed on-chain and reproducible by outsiders, and independent operators join the key federation on a published schedule.

## Who Sees What

| Party                 | Sees                                                                                       | Never sees                                                                            |
| --------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
| **You**               | Your own obligations, net positions, statements, and the evidence behind your own outcomes | Anyone else's positions or relationships                                              |
| **Your counterparty** | Exactly the obligations you both signed                                                    | Your other counterparties, your net position, your flow with anyone else              |
| **The operator**      | Encrypted records and public commitments                                                   | Any member data in the clear - no master key, no view tier, no decryption path exists |
| **A supervisor**      | Your own book, through access you grant - scoped, time-bounded, revocable, and audited     | Anything you did not grant; there is no regulator key                                 |
| **The public**        | Proofs, commitments, and filtered network aggregates                                       | Amounts, parties, or any per-run figure                                               |

## Who You End Up Facing

Netting has a reputation for changing who you face. This one cannot:

* **Your counterparty never changes.** A clearing house would step into every trade and become your counterparty - that is novation, and it never happens here. Your accepted trade stays yours, and money forwards only along edges that already exist.
* **The perimeter guarantee.** You only ever face firms your policy approved, and netting never expands that set. Nobody outside your perimeter ever receives value from you.
* **Compliance can exclude, never redirect.** A rule can mask a pairing out of a run; it can never map money somewhere new, and a blocked pairing never becomes anyone's claim on you.
* **A default hits the pair, never the pool.** There is no default fund and no mutualized loss: you can only ever lose your own position with the defaulter.

## The Lines That Never Move

* **No clearing house.** Debts are extinguished by set-off between the parties that signed them - never novated onto a middleman.
* **No pooled custody.** Funds move wallet to wallet on rails you already use; the protocol never holds them.
* **No locked capital.** No margin, no pre-funding; your wallet is untouched until the pull window opens.
* **No trust-us phase.** Value flows only when the full stack is live: the proof verified on-chain, the engine attested, replicas running, and a member recovery drill demonstrated. Until then: test networks and shadow runs only.
* **No edit path.** Obligations are write-once; corrections are signed offsetting entries, and nobody - operator included - can alter what you signed.

## Keep Going

<CardGroup cols={2}>
  <Card title="How It Works" icon="gears" href="/netting/how-it-works">
    The clearing run step by step, funding, and where the residual goes.
  </Card>

  <Card title="Where It Applies" icon="diagram-project" href="/netting/where-it-applies">
    One clearing layer, many kinds of debt - and why every new lane raises everyone's ratio.
  </Card>
</CardGroup>