Technology
A permissioned ledger, engineered for regulators.
Transactions confirm in parallel, validators are licensed institutions rather than whoever holds the most stake, and every property that decides whether money software can be trusted is enforced in code.
How settlement works
A shared ledger that regulated institutions can legally run.
Transactions confirm in parallel rather than queueing for blocks. The trade PayAll makes deliberately: it gives up censorship resistance and permissionless access, because that is the price of being allowed to operate where the unbanked live.
- Who validates
- Locally licensed financial institutions only — banks, mobile-money operators and payment providers already regulated in that country. There is no public validator access.
- What regulators get
- A read-only supervisory node with live visibility into ledger state, reserve balances and compliance metrics.
- Court-ordered freezes
- Supported by design, and they execute within 60 seconds. This is a feature, not a concession.
- Where the money sits
- Reserves are held in domestic regulated banks, per currency, while one ledger settles across borders — satisfying data-localization law and interoperability at once.
- Backing
- Each unit is backed 1:1 by real currency, at 100% collateral, with monthly independent reserve audits. It earns no yield, cannot leave the network, and is redeemable for cash at any time.
Status, stated plainly: the ledger, its consensus mechanism and the currency brand and burn run on a test network today. They are not live in production, and we won't describe them as if they are.
The full technical architectureBuilt like infrastructure
Money software fails in specific ways. These are closed.
A payment ledger is not a CRUD app. The properties below are the ones that decide whether a system can be trusted with other people's money, and they are enforced in code rather than in policy.
Double-entry, every movement
Every transaction has balanced ledger legs. The books are auditable end to end, not reconstructed after the fact.
Concurrency-safe by construction
Idempotent processing and row-level locking on balances mean simultaneous double-spend attempts are structurally rejected. Automated tests exercise this property — it isn't assumed.
Exact decimal arithmetic
No floating-point rounding anywhere near a balance.
Anchored, then reconciled
Every money flow is anchored to the ledger, with a periodic reconciliation pass that catches and re-anchors anything missed.
Keys never leave the hardware
Phones sign inside the secure enclave. Terminals and scanners sign inside a tamper-resistant secure chip that erases itself if the device is physically opened.
Relays can't read what they carry
Payment payloads stay encrypted through the network gateways. Only the core engine can decrypt them.
- 470
- tests gating every deployment
- 0%
- transaction loss under failure
- 4.2s
- average full recovery
- Zero
- consensus divergence
Failure-tested under sustained load with gateways, validators and edge units killed at random.
An independent third-party security audit is planned, not complete. We would rather say that here than have you find out later. It is the single largest open item before production scale, and it is being scoped with a specialist firm.
On this page — in build
- 01The four-layer architecture, in full
- 02Ledger internals — vertices, parents, tip selection
- 03Consensus — validators scored on performance and compliance
- 04State reconciliation and batch anchoring
- 05The threat model, end to end
- 06Cross-path coordination between mobile and radio
- 07Performance — laboratory results, stated as such