How it works

One signed receipt per handover.

A gift card code passes through several hands between the brand and the customer. Trace adds one signed record per handover, written by the party that already handles that moment and daisy-chained to the record before it, without the code, the price, the customer or a name. It is designed for existing order flows: the code ID travels in a reference field you already have.

Three steps

1
Assign a code ID
A random identifier is created at issuance. The gift card code itself is not shared.
2
Record handovers
Each participating party writes a signed receipt for the handover it already knows about.
3
Review signals
Brands review distribution patterns and exceptions by hop number and role, not downstream identities.

One hop up, one hop down

Every participant sees the records where it is the seller or the buyer, and nothing else. Choose a viewpoint.

Brand
not visible
Processor
not visible
Aggregator
pseudonym it gave you
Reseller
you
Customer
pseudonym it gave you

The reseller sees the aggregator above and its own sale below. Not the processor, not the brand, not the other resellers.

What a record holds

Each record points at the one before it and is signed with a key only the writer holds. Nothing can be inserted, removed or rewritten without the chain showing it.

On a record

✓A random code ID, assigned at issuance
✓The seller and the buyer, as pseudonyms
✓What happened: issued, allocated, fulfilled, shipped, sold, resold, redeemed or voided
✓Sector, channel and country where they apply
✓The time
✓The fingerprint of the record before it
✓The signature of the party that wrote it

Never on a record

✗The gift card code
✗The price paid
✗The customer
✗A company name

Accountability travels one hop at a time

The registry flags a hop: a brand rule, a volume spike, a duplicate sale.
The party above it is told its buyer is flagged. It knows exactly who that is.
It acts, or the notice travels one more hop up. It always ends at a party someone has verified.

Who sees what

The same rule, written out for every role.

Who	Sees	Does not see
A participant	Records where it is the seller or the buyer. Its counterparties as the pseudonyms they gave it. Notices and cases on its codes, by hop number.	Any other record or pseudonym.
The brand	Its own handover to the processor. Aggregates: hops, intact rate, sectors, countries, flagged entities per hop as counts and ranges. In a case, the chain by hop number and role.	Any pseudonym below its processor. Any name.
The registry	Pseudonyms, public keys, registered relationships, code IDs, states, times, signatures.	Names, codes, prices, customers.
A customer or exchange	Once advisory checks are live: the answer for one code ID, valid, redeemed, voided, flagged, broken or unknown, plus the hop count.	Everything else.

Scope today

Reporting and verification are what Trace does today. Advisory checks are planned next. Enforcement through a processor is a later capability. The registry does not void a code or refuse a redemption.

Report and verify

Today

Signed records are collected and verified, aggregates computed, signals raised by code ID and hop, cases run by hop number. The brand acts through its processor and its own rules.

Advise

Planned next

The pre-sale check, may I sell this code ID to this buyer, and the public check by code ID. Refused if the code is redeemed, flagged or altered, or the buyer is blacklisted by the brand.

Enforce

Later, with the processor

A processor checks the chain at activation and redemption and applies the brand’s policy. Not available today, and never something the registry does on its own.

Compared with classic track-and-trace

For readers who know the alternatives. Classic schemes ask every partner to upload who it sells to; the middle refuses, and the scheme dies. Trace records the handover without the names.

	Today	Classic track-and-trace	Atomicrails Trace
Between issuance and redemption	✗Unrecorded	Each partner uploads its sales	✓One signed record per handover, written by the party that already knows
Who leaked a code	✗Unknown. Whole sectors get cut off	Known to the operator and the brand	✓The hop where it happened, by hop number and role
A partner's customer list	Stays with the partner	✗Shared with the scheme and the brand	✓Stays with the partner. One hop up, one hop down
Names at the operator	None	✗All of them	✓None. Pseudonyms in the registry, names in a vault with a 2-of-3 key
Records after a loss	✗Rebuilt from emails and spreadsheets	The operator's database	✓Signed, linked, fingerprint anchored publicly
Who acts	The brand, late	The scheme operator	✓The brand, through its processor and its own rules
A partner's integration	None	✗A new feed of its sales	✓A reference field it already has, plus a signed record per handover

See it on sample data

A walk-through of the Trace reporting view takes half an hour and needs nothing of yours.

Request a demo