Authenticated provenance
Ed25519 event signatures, replay rejection and key retirement/compromise handling help identify an authorized source and detect modified or replayed statements.
Atlas Transaction Index / ATXI
Provenance at each handoff.
Privacy at each boundary.
ATXI separates transaction identity, authenticated source reports, restricted evidence and institution-facing operations.
The integration model
- Institutional systemsProvide approved references and assertions.
- Authorized ingestionValidate identity, permissions and signed input.
- Transaction indexConnect lifecycle, movements and case history.
- Scoped institutional viewsDisclose only the permitted records and fields.
The engineering release includes an institutional API, Python signing SDK and signed batch ingestion. Limited ISO 20022 status/reference extraction and normalized CSV candidate parsing support integration development. These offline parsers are not live bank connectors.
Production integration requires an institution-approved mapping contract, authorized source credentials, tested disclosure rules and an independently qualified deployment.
What cryptography establishes
Integrity and confidentiality
The local release implements encrypted payload/evidence storage, audit-chain verification and visible-evidence integrity checks. Institutional key custody and retention infrastructure still require external qualification.
A valid signature is not proof of settlement.
It supports attribution and integrity of a statement. The business meaning, correctness and completeness of that statement still depend on its source and supporting evidence.
Privacy boundaries are part of the product.
- Knowing an ATXI identity does not grant access to a transaction.
- Institution, role, membership, purpose and disclosure rules constrain access.
- Private notes and restricted evidence remain inside the relevant authorization boundary.
- Public Atlas analytics and NOVA website monitoring receive no transaction records, banking evidence, credentials or institutional case data.
- Public website monitoring is limited to operational information such as reachability, TLS, page checks and deployment state.