SURFACE · 04 / STN · ON-CHAIN

Sovereign Trade Network.

The confidential matching and settlement spine. Encrypted intents are matched by computing directly on ciphertexts and settled atomically across federated venues. The matching engine never sees plaintext, and compliance travels with the trade.

stn · session● ENCRYPTED

modeM2 · RFQ + FHE settle

cryptoTFHE · ERC-7984

intent_leak0

settleatomic · all-or-nothing

policy_commit0x9f4a… · carried

§ 01 / Network

Match on ciphertexts. Settle atomically.

KYB-admitted OMA accounts submit encrypted intents into the matching pool; compatible orders are identified without any party seeing plaintext; matched counterparties selectively decrypt and settle atomically across regional operators, each licensed in its own jurisdiction.

fig.03 / stn settlement spineconfidential · atomic · federated

§ 02 / Execution Modes

Three modes. One control plane.

The execution mode changes what is visible, never whether the trade is compliant, atomically settled, or evidenced. All three share the same OMA policy gate and the same audit-trail properties.

MODE · 01

Transparent (M1)

Baseline flow inside one trust boundary: internal transfers, treasury rebalancing, sub-fund moves. Policy gate, atomic settlement, and evidence fully enforced, with no privacy machinery.

MODE · 02

Confidential Settlement (M2)

The default institutional mode. Dealer-panel RFQ preserves familiar quoting; settlement executes with FHE-encrypted amounts and addresses. MEV and post-trade leakage eliminated.

MODE · 03

Sealed-Intent Matching (M3)

Maximum pre-trade privacy. Fully encrypted intents matched by FHE comparison in a shared pool; only matched counterparties can decrypt the specific fields they need to settle.

§ 03 / Lifecycle

Policy and privacy compose.

Policy runs on plaintext inside the institution’s control plane, before the intent is ever encrypted. What reaches STN is not a trade that needs checking but a trade with cryptographic proof it has already been checked. Privacy at the venue costs nothing in compliance rigor.

00:00 · POLICY FIRST

The intent clears the OMA Validator on plaintext, inside the institution's own boundary, before anything is encrypted. What travels carries proof it was already checked.

STEP · 01/04

00:01 · ENCRYPT

Economic content is sealed into FHE types; routing metadata stays clear so the pool can pre-filter compatible pairs without ever decrypting.

STEP · 02/04

00:02 · MATCH

Compatible orders are found by computing directly on ciphertexts. No participant, the operator included, sees plaintext order details.

STEP · 03/04

00:03 · SETTLE

Matched counterparties selectively decrypt only what they need. Atomic all-or-nothing settlement; evidence emitted under the same policy commit.

STEP · 04/04

§ 06 / Access Testing

Join the waitlist for access testing.

Access is rolling out to a scoped cohort of regulated institutions through structured, milestone-gated pilots. Drop your details and we'll coordinate briefings, mandate intake, and pilot onboarding as your category opens.

OR · contact@ontrade.finance