Trust centre
Controls that stand up to operational and examiner review.
The diligence answers, stated plainly, including the ones that are limits rather than features. A vendor questionnaire should be answerable from this page.
What we do not do
Read this first. It is shorter than the capability list and it decides most questions.
Not registered with the SEC, not a FINRA or SIPC member. BD and ATS functions are performed by unaffiliated registered firms.
We never hold client keys or client fiat. Assets sit at a qualified custodian; cash sits in escrow at the settlement bank.
We never lend our own balance sheet, never front costs, never guarantee performance and never take first loss.
Control matrix
Procedure, the regulated gate, who approves, what evidence is retained.
| Procedure | Regulated gate | Approving role | Evidence retained |
|---|---|---|---|
| OPS-01 Issuance | Filing; closing allocation | Registered principal | Document hashes, filing confirmations, allocation computation |
| OPS-02 Qualification | Case decision | Compliance officer | Verification results, screening hits, suitability score, decision record |
| OPS-03 Subscription | Pre-allocation review | Compliance officer | Executed documents, payment match, compliance snapshot |
| OPS-04 Settlement | Threshold approval | 1, 2 or N-of-M officers | Hash-chained ledger entry per movement, reconciliation result |
| OPS-05 Transfer | Restriction clearance; structural actions | Compliance officer; principal | Restriction analysis, recipient qualification, dual-ledger references |
| OPS-06 Automation | None — no authority | n/a | Agent identity, input snapshot, artefact, and the operator who acted |
Security posture
Stated as posture, not as certification. We claim no certification we do not hold.
Key management
Segregation by construction — the platform never holds signing keys. Custodian API access is per-request RS256 JWT signed, scoped per vault role, with twelve roles separating initiation, approval and view.
Evidence integrity
Append-only, SHA-256 hash-chained, write-once. Six-year retention. Any gap or reordering in the chain is detectable and is itself an exception.
Access control
Role-based, tenant-isolated, least privilege. Approval authority is held by named people in your firm, not by shared accounts and not by us.
Change control
Policy versions are recorded on every decision, so a decision can be replayed against the rules as they stood at the moment it was made — not as they stand today.
Automation boundary
No automated component holds approval, execution or filing authority. This is enforced in the policy engine, not by convention, and the boundary is visible in the evidence record.
Incident model
Exception queue first, escalation second, disclosure third. Reconciliation discrepancies above threshold stop the affected workflow rather than netting silently.
Third parties
Who touches what. A subprocessor list is part of diligence, not an afterthought.
| Function | Category | Data exchanged | If it fails |
|---|---|---|---|
| Identity verification | KYC vendor | Government ID image, liveness capture, match result | Qualification queue holds; no fallback to self-certification |
| Entity verification | KYB vendor | Entity name, EIN, registry and UBO data | Manual review case raised to compliance |
| Accreditation | Verification provider | Income, net worth or licence evidence, expiry date | 506(c) offerings block; 506(b) may proceed on reasonable belief |
| Sanctions and AML | Screening vendor | Name, DOB, jurisdiction, wallet address | Hard stop — no transaction proceeds unscreened |
| Custody | Qualified custodian | Vault instructions, balances, transaction references | Settlement halts; positions and evidence unaffected |
| Proof of reserve | Oracle network | Attested balances published on-chain | Attestation staleness surfaces on the page; balances still reconcile internally |
Examiner readiness
On request, the platform exports the trade blotter, the full audit trail, investor files and a cap table snapshot in examination format, scoped to a date range and an offering. The export is generated from the same append-only record the workflows write to — there is no second system to reconcile it against, which is the point.