Skip to main content
Request a demo
Platform

Tokenization OS

Most tokenization stacks are four products and an integration layer. The integration layer is where the register stops agreeing with the ledger, and where a status ends up meaning something different from the entries behind it.

One transaction boundaryThree stacked elements — a record, a rule and a ledger posting — enclosed by a single boundary, indicating that all three commit together or not at all.ONE TRANSACTION BOUNDARYRecordwhat is trueRulewhat is permittedPostingwhat it did to the bookscommit together

What it changes

  1. One transaction boundaryA payment marked settled and the ledger rows recording that settlement commit together or not at all. There is no path on which a payment is settled while the money it settled is unaccounted for.
  2. Pure engines, thin servicesState machines and arithmetic live in dependency-free packages that test in milliseconds. The service layer is the only thing that touches the database, and the interface authorises, acts, audits and revalidates — nothing else.
  3. Invariants enforced twiceThe balance rule is checked before anything is written and again by a deferred constraint at COMMIT. Not redundancy — two independent failures, in two different places.
Ask, agree, then actThree steps. One person requests, a different person approves, and only then does the state change. The approval binds to what was requested, so editing it afterwards invalidates the sign-off.Requestone personApprovea different oneActnow it movesThe approval binds to what was asked.Edit it afterwards and the sign-off is void.
Every irreversible act on this platform takes this shape, whatever the subject of the page: one person asks, a different one agrees, and only then does anything move.
How the platform is arrangedFour stages — asset, compliance, offering and register — connected left to right, all enclosed by a single transaction boundary that rests on a double-entry ledger.AssetStructured and documentedCompliancePolicy in forceOfferingA book that is derivedRegisterHolders of recordOne transaction boundaryA movement and the entries behind it commit together, or neither doesDouble-entry ledgerEvery movement, both sides, in minor unitsBalanced at COMMIT
Four stages inside one transaction boundary, on one ledger. A register that disagrees with the cash is not a state the software can reach.

What it includes

Asset definition engine67 classes resolved from group profiles plus per-class overrides, with token standard selection and derived readiness.
Compliance policy engineRules as reviewable data over a closed attribute vocabulary, versioned and snapshotted onto every decision.
Offering and allocationA book derived from subscriptions, deterministic scale-back, and residuals returned rather than kept.
Ownership registerPositions rebuilt from confirmed movements and checked against running totals.
Double-entry ledgerBalances derived from entries, corrections as reversals, append-only enforced by the database.
Lifecycle servicingDistributions, corporate actions and redemptions, each with its own state machine and approvals.

Evidence, not assertion

Controls that have been verified running, rather than described.

  • Row-level security verified to isolate: with no tenant context the application role reads zero rows.
  • A cross-tenant write is refused by the database regardless of application code.
  • The deferred balance constraint refuses debits of 100 against credits of 99 at COMMIT.
  • Ledger entries and audit events cannot be updated or deleted by the application role.
What counts as evidenceThree rows. A control described in a document is unticked; a control enforced by code and one refused by the database are ticked. Only the second and third are evidence that something holds.Described in a documentEnforced by codeRefused by the database
A control written down is not a control. Only the two lower rows are evidence that something holds, and both are what the list beside this describes.

See it against something real.

Bring an instrument you are actually considering. Structuring it is the only way to judge whether the model fits.

Request Enterprise DemoBack to platform
Your instrument, against this modelAn unspecified asset on the left feeds four stages: structure, compliance policy, the offering book and the register. The asset is drawn as an outline because it is the reader's, not the platform's.Your assetwhatever it isStructurePolicyBookRegister