Canton Assurance Layer
Sign in

Proof without exposure

Prove solvency, coverage and settlement to the people who need to know, without opening the books.

One private truth on Canton, many verifiable views. Publish a committed report, hand every customer a proof they can check in their own browser, and give auditors evidence that stands on its own for years.

Open the console Verify a proof

Publisher workspace

Upload balances, design what each audience sees, publish a signed report with one proof per customer, anchor it to the last.

Customer portal

Find your proof for every venue that lists you and verify it here, in your browser. Your balance never leaves the proof file.

Auditor workspace

Every venue that granted you access, side by side: coverage, assurance levels, anchor chains and evidence packs that re-verify.

Why we build this

Canton made institutional markets private. We make their most important claims verifiable.

Canton keeps balances, positions and settlement private, and that removes the public evidence a public chain produces as a side effect. Customers, counterparties, auditors and regulators still need to know: do the assets exist, is the collateral sufficient, did both settlement legs complete, has this report been rewritten since it was published?

Institutions do not need to make everything public. They need controlled verifiability: proving one specific claim to one specific audience without exposing the book behind it. This project turns a private ledger snapshot into a signed, selectively disclosed, independently verifiable statement — proof of solvency first, with reserve coverage, repo collateral, fund NAV, settlement integrity and holder eligibility on the same machinery.

The deliverable is a format, not a product. A specification anyone can implement, a conformance corpus that decides disagreements at a named case, and verifiers that need none of the publisher's software. Our implementation is one of several we intend to exist.

Who builds it

Rocky, a derivatives and spot exchange built natively on Canton, has published daily solvency reports through this layer since August 2026. Everything is Apache-2.0 in one public repository, with the specification — not our code — as the artefact under review. Proposals to the Canton Development Fund are public and adoption-gated.

Five things that will not change

  1. 01
    Verification stays in the client

    A server is a delivery mechanism, never an authority. Nothing asks a reader to trust the publisher, or us, for the arithmetic.

  2. 02
    A format, not a product

    A specification anyone can implement and a corpus that settles disagreements at a named case. Our implementation is one of several.

  3. 03
    Say what is proven and what is asserted

    Assurance levels exist so a recomputed total and a signed claim are never reported in the same word.

  4. 04
    Both sides stay private

    Nothing depends on publicly observable protocol metadata; every input is the publisher's own ledger view or public network configuration.

  5. 05
    Wire compatibility

    A change that breaks a golden vector ships under a new domain string. Evidence signed last year verifies today.

Milestones

What has shipped, and what comes next

9 of 13 delivered. Every delivered item is running in production at Rocky and covered by the conformance corpus; every planned item is a public Development Fund proposal with adoption targets.

  1. Wire format v1.2, frozen

    Delivered2026-08

    A byte-level specification with golden vectors; every normative section has at least one conformance case. Any change that breaks a vector is a new version, never a silent edit.

  2. Report and proof documents

    Delivered2026-08

    The commitment becomes a signed document others can consume: Ed25519 signatures, a disclosure manifest inside the signature, assurance levels the verifier enforces.

  3. Canton reserve verification

    Delivered2026-08

    The asset side read from a live participant at a pinned offset and committed into a signed coverage report, so coverage is checked against holdings, not a claim.

  4. On-ledger anchoring

    Delivered2026-08

    Each report links to the previous one and its digest is anchored on Canton; a restated snapshot or a rewound offset shows as a break in the chain.

  5. Selective disclosure profiles

    Delivered2026-08

    One format covers solvency, reserve coverage, repo collateral, fund NAV, DvP settlement and holder eligibility, with hierarchical group → entity → customer commitments.

  6. Independent verification toolkit

    Delivered2026-08

    A CLI, an offline single-file browser verifier, JSON Schemas and evidence packs; one proof of a million-customer book verifies in under a millisecond.

  7. Three implementations agree

    Delivered2026-08

    Rust, TypeScript and a dependency-free Python verifier written from the specification text alone, compared on 61 conformance cases in CI.

  8. Hosted console

    Delivered2026-09

    Publisher workspace, customer portal, auditor workspace and public transparency page, self-hosted with one command, in English and Simplified Chinese. Verification never moves server-side.

  9. Transaction simulator

    Delivered2026-09

    Dry-run a Ledger API command on the participant before submitting it: exact effects, a catalog-backed diagnosis of any rejection, and a fee quote. Read-only, never a signer.

  10. Standardisation

    In progress2026-10 → 2027-03

    A second implementation by an organisation outside Rocky, a third-party security review published in the repository, packaged verifiers, and a Canton Improvement Proposal for the wire format.

  11. Institutional RWA disclosure profiles

    Planned2026-12 → 2027-09

    The repo, fund NAV, DvP and eligibility profiles exercised end to end by real issuers and platforms, with custody read from token-standard holdings at the same ledger offset.

  12. Disclosure console and compliance evidence

    Planned2027-04 → 2027-12

    Anchoring on a synchronizer carrying real value, keys behind a KMS or HSM boundary, scheduled publishing, and audit firms issuing opinions from the auditor workspace.

  13. Attested aggregation

    Planned2028

    Building the tree inside a trusted execution environment so that completeness — every customer is in the tree — becomes remotely attestable rather than customer-policed.

Dates for planned work follow the public roadmap and depend on Development Fund timing and on adopters other than Rocky. Nothing here is a promise about a date; everything delivered is verifiable today.