Platform
Tokenization OS
Most tokenization stacks are four products and an integration layer. The integration layer is where the register stops agreeing with the ledger, and where a status ends up meaning something different from the entries behind it.
What it changes
- One transaction boundaryA payment marked settled and the ledger rows recording that settlement commit together or not at all. There is no path on which a payment is settled while the money it settled is unaccounted for.
- Pure engines, thin servicesState machines and arithmetic live in dependency-free packages that test in milliseconds. The service layer is the only thing that touches the database, and the interface authorises, acts, audits and revalidates — nothing else.
- Invariants enforced twiceThe balance rule is checked before anything is written and again by a deferred constraint at COMMIT. Not redundancy — two independent failures, in two different places.
What it includes
Asset definition engine67 classes resolved from group profiles plus per-class overrides, with token standard selection and derived readiness.
Compliance policy engineRules as reviewable data over a closed attribute vocabulary, versioned and snapshotted onto every decision.
Offering and allocationA book derived from subscriptions, deterministic scale-back, and residuals returned rather than kept.
Ownership registerPositions rebuilt from confirmed movements and checked against running totals.
Double-entry ledgerBalances derived from entries, corrections as reversals, append-only enforced by the database.
Lifecycle servicingDistributions, corporate actions and redemptions, each with its own state machine and approvals.
Evidence, not assertion
Controls that have been verified running, rather than described.
- Row-level security verified to isolate: with no tenant context the application role reads zero rows.
- A cross-tenant write is refused by the database regardless of application code.
- The deferred balance constraint refuses debits of 100 against credits of 99 at COMMIT.
- Ledger entries and audit events cannot be updated or deleted by the application role.
What this deployment does not do
Stated plainly
No payment provider, KYC provider or blockchain signer is connected in this deployment. The rails that need one report as unavailable rather than pretending to work.
See it against something real.
Bring an instrument you are actually considering. Structuring it is the only way to judge whether the model fits.