Records and privacy

Risks addressed

The books drift from the register.
An act cannot be traced.
An investor’s data reaches another investor.
Data leaves your perimeter.

Controls

Reconciliation matches every mint and burn to the order that planned it, and the register to outside records, on a schedule. A blocking finding holds the asset at the venue until two approvers release it. A backed instrument’s reserve is matched to its locked holdings, to the backed instrument’s supply and to its minimum cover.
Every act of the venue is recorded with who asked, who approved and the ledger transaction it became, alongside an ordered event feed and exports.
Every read names the point on the ledger it was read at, and can be read again at that point, so reports can be reproduced.
Each party sees only what it is party to, and investors never see each other’s orders or holdings. No personal data reaches the ledger.
NodeAsset and its stores run on your infrastructure, so your data stays with you.

Evidence

Reconciliation runs, findings and releases.
Operations, approvals, events and exports.
Each party’s view of the ledger.

Matrix rows CTL-16 to CTL-19: see the control matrix.

Reconciliation

The venue’s plans and outside records are compared with the ledger. Reconciliation is the venue’s own control: a blocking disagreement holds the asset at the venue.

How it works: what is matched

Compared	Against	Finds
Every mint and burn	The order or distribution line that planned it	A mint with no order behind it; a burn nobody planned
Each backed instrument’s reserve	Its locked holdings, the backed instrument’s supply, and its minimum cover	A holding not as the reserve records it; outstanding units the supply disagrees with; a cover below the minimum
Each holder’s record of units	The holder’s units on the registry	A record and a holding that disagree
The register	The transfer agent’s statement of holdings	An account counted differently
A period’s distribution	The administrator’s distribution list	A line that differs, or one paid that the list leaves out
Transfers that did not pass through NodeAsset	The asset’s policy	A holder no longer admitted; a balance over its limit; a transfer in a closed window

Outside records arrive as statements, kept exactly as received with their hash: statements of holdings as semt.002, bank statements as ISO 20022 camt.053, and files from administrators and transfer agents. Reconciliation compares three kinds with the ledger: distribution lists, statements of holdings and NAVs. A bank or custody statement is kept as received, and not compared. Findings about who holds, about supply, or about an unplanned mint or burn stop the asset; findings about an amount or a time are listed for review. See Reconciliation.

Audit trail

Contracts live on each party’s node; the venue’s database holds what was decided and who decided it.

How it works: the records and where they are kept

Record	What it keeps
Operations	Every write: the request, who asked and under which role, its result or the problem that refused it, and the ledger transaction it became. A finished operation never changes
Approvals	Every four-eyes action: its maker, each approver and when, and the decision
Events	One ordered feed of the ledger’s facts and the venue’s acts: operations, approvals, reconciliation, holds, restrictions, distributions
Reconciliation runs	Each run’s point on the ledger, its checks, findings and verdict
Policies and asset records	Every version, with its approvers and effective time
Outside statements	Each statement as received, with its source and hash

Store	Holds	Where
Each party’s node	The contracts it is party to	Each party’s own infrastructure
The ledger projection	The ledger as the venue’s party sees it	Your perimeter
The venue’s database	Asset records, policies, holders, operations, approvals, distributions, holds, reconciliation, statements, events	Your perimeter
Your identity provider	Your people and systems, and their roles	Yours

How it works: exports and retention

Export	Format
The cap table at any point, by holder of record and beneficial owner	JSON or CSV
Investors by residency	JSON
A distribution’s frozen plan	JSON or CSV
A holder’s statements and tax statements	JSON
A reconciliation run’s report	JSON
The event feed	JSON

By default every row is kept. A deployment may set an age per kind of history (reconciliation runs, events, operations, approvals), and a daily pass deletes older rows, never one a hold, an open settlement or a kept operation still names. A backup keeps what retention later deletes. See Configuration reference.

Who sees what

Canton shares a contract only with its parties, so each party sees the transactions it takes part in and nothing else.

How it works: each party's view

Party	Sees	Does not see
	Its own payment requests, allocations, admission and credential, orders and claims, and its own legs of each settlement	Another investor’s orders, legs or holdings
	Every settlement it executes, and every order, claim and admission it records. As the provider of a registry, every holding on it	The KYC evidence behind a claim: only its hash and reference
	Its registry’s batch of each settlement; as a signer of the consent, the whole settlement; its holders’ credentials	Other registries’ holdings
	Its own registry’s batch: the payment asset’s holdings and allocations	Anything of the fund: its register, orders or units
	The orders and claims it prices, and its own prices	Holdings, and the legs of a settlement
DA’s operator	Every allocation and settlement batch on its registry, configurations and the block list	The venue’s own contracts

DA’s operator observes every settlement on its registry, and the venue, as a registry’s provider, sees every holding on that registry: for a tokenized deposit, the bank’s whole deposit book.

How it works: personal data

The ledger holds party ids, and each holder’s claims as codes with their expiry, but no name and no document.
The venue’s database holds each holder’s id and party, an optional display name, its KYC provider and case reference, and its attributes with their proof hash, each version kept, as well as the person behind every operation and approval.
NodeAsset does not hold the KYC evidence itself, which stays with whoever ran the KYC.

Through the API, every read is confined to the caller’s role: an investor reads only its own holder, a monitoring system only health and redacted control events.

The story

Control families

For auditors

Records and privacy

Risks addressed

Controls

Evidence

Reconciliation

Audit trail

Who sees what

​Risks addressed

​Controls

​Evidence

​Reconciliation

​Audit trail

​Who sees what

Risks addressed

Controls

Evidence

Reconciliation

Audit trail

Who sees what