Multilateral OTC-derivatives compression on Canton where the operator cannot read any participant's trade terms.
Counterparties tear up offsetting bilateral trades and atomically redistribute counterparty exposure. The operator coordinates the cycle without being able to read any participant's positions, sensitivities, or trade terms.
October 2026: a cycle executed on Canton DevNet through a Decentralized Party that CompressRail and BitSafe operate together, rejected with one approval and executed with both. What ran, and its limits
| Can see… | Participant A | Participant B | Operator | Regulator (A) |
|---|---|---|---|---|
| A's economic terms | yes | no | no | scoped |
| B's economic terms | no | yes | no | no |
| Cycle topology and validity | own legs | own legs | scoped | no |
What "operator-blind" means — precisely
The operator cannot read a participant's economic terms — positions, sensitivities, notionals or rates. Two mechanisms enforce this together: the operator is never a signatory or observer on a position-bearing contract, and every economic field is written on-ledger only as authenticated-encryption ciphertext, with the operator holding no decryption key.
What this is not. The operator and every firm invited to a cycle receive its transaction metadata — who the torn-up and new trades are between, as ciphertext — and a firm can infer some amounts from its own trades and the outcome. Private matching is on the roadmap, not in this build; reduced execution visibility is shown in the governed DevNet run, not in this hosted demo. This is not zero-knowledge, not fully homomorphic encryption, and not MPC. It does not make replacement trades legally enforceable, and it never takes custody of any asset.