Privacy model and boundary
Privacy claims in this space are easy to overstate, so this page states the exact boundary — what the operator can and cannot see, and what CompressRail is not.
What "operator-blind" means, precisely
The operator cannot read any participant's economic terms — positions, sensitivities, notionals or rates. Two mechanisms enforce this together:
- Daml stakeholder scoping.The operator is never a signatory or observer on any contract that carries a participant's trade, so it is not notified when those trades are created and never holds one as an active contract. When it executes a cycle it does receive the trades being torn up and the new legs, as ciphertext (below).
- Application-layer encryption. Every economic field is written on-ledger only as authenticated-encryption ciphertext plus a hash commitment, and the operator holds no decryption key. This second layer is necessary, not redundant: on Canton, the participant that submits a transaction interprets all of it, so anything stored in cleartext would be visible to whoever submits.
What is exposed — to the operator and to every firm in a cycle
Economic payloads are encrypted, and the operator party is not a decryption recipient. The operator and invited cycle participants receive transaction metadata, including counterparty identities and ciphertext. This does not guarantee topology privacy or prevent inferences from participants' own trades and cycle outcomes. In this build the matching runs with all inputs in one place. Private matching and reduced execution visibility are separate roadmap items. The current multi-node test uses a shared test process holding participant keys.
- From the moment a cycle is proposed, every invited firm sees which pairs are to receive replacement trades — including a firm that later declines.
- When the cycle executes, the operator and every committed firm receive the whole transaction: every trade torn up and every new leg, with counterparties, references, ciphertext and commitments. In Daml, a party that is an informee of an action also sees its consequences. Measured on a three-node run by reading each party's ledger-effects stream; its active contracts and flat stream do not show these trades.
- Inference.Reading nothing, a firm can still derive amounts. In a ring A–B 100, B–C 60, C–A 60, firm A knows its own C–A trade and sees that C receives no new leg, so it can work out that B–C is 60. The operator, which sees no amount, still learns that C's two trades offset exactly.
The privacy matrix
| Can see… | Participant A | Participant B | Operator | Regulator (A's) |
|---|---|---|---|---|
| A's economic terms | yes | no | no | yes (scoped) |
| B's economic terms | no | yes | no | no |
| Full cycle plan in cleartext | own legs only | own legs only | no | no |
| Cycle structure (who with whom), as ciphertext | yes, if invited | yes, if invited | yes | no |
| Own positions compressed | yes | yes | no | yes (scoped) |
This is enforced by Canton and verified by reading each party's own ledger view — not by filtering in the interface. The last row is a visibility proxy — whether a party's own trades were torn up by the cycle — not a computed margin number; initial-margin models (SIMM, SA-CCR) are out of scope. Its values describe the post-cycle state; the demo's privacy-matrix scoreboardcomputes this table live from real per-party projection reads, driven from a persistent disclosed trade (no cycle has run in that view), so that row reads "no" across it there.
What this is not
- Not topology-hiding, not inference-proof.The operator and every invited firm receive the cycle's structure, and amounts can be inferred from a firm's own trades and the outcome (above). Multi-party computation would remove the need to collect all inputs in one place; on its own it would not stop the result's parties from propagating at execution.
- Not zero-knowledge, not fully homomorphic encryption, not MPC.
- Not a legal-enforceability layer.CompressRail does not make a replacement trade legally enforceable, EMIR/CSA-compliant, or a counterparty creditworthy. Those are questions for the parties' own agreements and legal review.
- Not custody. CompressRail never takes custody of any asset. It produces compression instructions and records.
- Not production-grade key management. Key handling in this build is demo-grade, clearly labeled as such. Production key management (KMS/HSM, rotation, external signing) is future work.
- Authenticity is from the ledger, not the sealed box. The sealed payload is anonymous, so a leg's terms are trustworthy only together with the Daml signatories on the contract carrying its commitment — never standalone.
- No on-ledger record that a trade was offered up.Consent to the plan itself is bound: a participant commits on one specific cycle contract carrying that exact teardown list and topology, and neither field can change as commits accumulate. What is missing is the step before — nothing records that a listed trade was ever one the participant agreed to include, so the check is that the participant reviewed the list, not that the ledger can verify it did. Binding that via the modeled NominateIntoCycle marker is roadmap. Separately, no ledger can attest that a participant's own client showed it the list it actually committed to; the per-node tolerance check is computed against the list read back from the cycle contract, which narrows that gap without closing it.
Why Canton
The problem needs three properties at the same time, which Canton provides natively:
- Sub-transaction privacy — a party sees only the contracts it is a stakeholder of.
- Atomic multi-party composition — one transaction can archive many bilateral trades and create their replacements across many counterparties, all-or-nothing.
- Selective disclosure — a regulator can be added as a scoped observer without seeing the rest of the graph.
A public chain would expose positions, or hide them behind heavyweight cryptography with no native settlement. A centralized service would reintroduce the trusted operator that is the whole problem.