Security and compliance

Built for accountability. Designed for privacy.

Signed records, controlled access and privacy-preserving verification support investigations, auditability and compliance workflows. This page describes the Trace architecture as designed for the pilot. The legal statement of who operates Atomicrails and how we handle sanctions, fraud and complaints is on the compliance page.

Three components

Identities, records and proof of integrity live in three separate places. The registry we run only ever sees pseudonyms. The names sit in a vault we cannot open alone. A public anchor proves the log was not rewritten.

  1. Identity vault

    Run with an independent custodian

    • Verified participant identities
    • The name behind each pseudonym

    Opened only by 2 of 3 key shares

    Pseudonym only

  2. Registry

    Run by Atomicrails

    • Pseudonyms and public keys
    • Random code IDs
    • Signed handover records
    • Sector, country, time

    No names, no codes, no prices

    Fingerprint only

  3. Public anchor

    On a public chain

    • A fingerprint of the whole log
    • Published periodically

    Nothing readable, ever

The vault gives the registry a pseudonym, never a name. The registry gives the anchor a fingerprint, never a record. A name is resolved only through the 2-of-3 break-glass procedure, and that resolution is itself recorded and anchored.

What the registry holds

The registry receives a verified participant with a role, not a company. The gift card code is identified by a random ID the registry assigns at issuance, so there is nothing to brute-force and nothing to leak.

Holds

  • ✓Pseudonyms, one per participant per brand programme
  • ✓Public keys
  • ✓Registered relationships between pseudonyms
  • ✓Random code IDs, states and times
  • ✓Signatures and record fingerprints

Does not hold

  • ✗Gift card codes
  • ✗Prices
  • ✗Customers
  • ✗Company names
  • ✗The vault key

Protected identities and controlled break-glass access

Participants are verified once, in the vault, and take part under a pseudonym per brand programme. There is no reveal. The registry cannot disclose what it does not hold. When an investigation needs one identity, two of the three key shares open one pseudonym: Atomicrails and the custodian, or either with a court order. The opening is written to the log and anchored, so every participant can see that a seal was broken, and when.

Day to day, accountability does not need a name. A flagged hop is reported to the party above it, which knows its own buyer. Brands act through their processor and their own rules.

Signed, append-only records

  • Each record is signed with a key only the writer holds. Nobody, including the registry, can write in a participant's name.
  • Each record carries the fingerprint of the one before it, so the records daisy-chain from issuance to redemption. Inserting, removing or rewriting a record breaks the chain visibly.
  • A handover is two-sided: the buyer's next record confirms receipt, or the buyer disputes it.
  • The public anchor is a fingerprint of the whole log, published periodically. It proves integrity. It does not publish readable transaction details.

What we do not claim

  • No certification or regulatory approval is claimed for Trace. The records are evidence a brand and its partners can use in their own compliance work.
  • A signal is not a finding. A policy exception, a missing record or an unusual pattern is a reason to open a case, not proof of fraud.
  • The registry reports and verifies records. It does not void a code or refuse a redemption. Advisory checks are planned; enforcement through a processor is a later capability.

See it on sample data

A walk-through of the Trace reporting view takes half an hour and needs nothing of yours.

Request a demo