Non-repudiation means a party can’t later deny an action that bears their signature. In Tripart that rests on two facts: the signature is made with a key only that party controls (the platform never holds it), and the record is kept by every party to the escrow on its own infrastructure, not by the platform alone.
What is recorded
| Record | What it holds | Who keeps it | Status |
|---|---|---|---|
| Ledger transactions | Every state change of every escrow, with the parties whose authority it required | Each party’s own ledger node keeps its own copy of the escrows it is on | Live |
| Personal and institution signatures | A person’s wallet signature, or an institution’s hardware-held key signature, on each transaction it authorizes | On the ledger, with the transaction | Live |
| Signed draft approvals | Before an agreement goes on the ledger, each depositor and beneficiary signs the exact version’s fingerprint; the signatures travel with the contract | On the ledger; anyone who holds the contract can re-verify them offline | Live |
| Escrow timeline | Every state an escrow passed through and the step that moved it, closed escrows included | Each party sees what its ledger shows it; rebuildable from the ledger | Live |
| Compliance decisions | The compliance officer’s decision on a flagged payment, with notes and evidence; a clearance is anchored on the ledger | Platform records plus the ledger | Live |
| Verification attempts | Every oracle and verification attempt, successful or not, after its signature is checked | Platform records; verified signals on the ledger | Live |
| Key ceremonies | Each change to an institution’s keys, prepared, signed and submitted as a formal ceremony | The ledger’s identity records | Live |
| Per-action evidence record | For every action at L2 or above: what was done and at what level, the party bound, the person who acted, the authority relied on, how they authenticated and when, the transaction fingerprint, and the outcome (submitted, refused, or stale) | Write-once storage, written before the result is reported | Rolling out |
| Key-use reconciliation | The key provider’s own log of each use of an institution-held key, matched against the evidence records | Write-once storage | Rolling out |
What stays off the ledger
- Personal data. Names and emails never go on the ledger. A person appears there as a stable, tokenized identity reference; the interface shows the name to viewers entitled to see it.
- Documents. Evidence documents live in encrypted vaults; the ledger keeps only a content fingerprint and a storage reference, so a document can be proven unchanged without being published.
- Sensitive fields. An agreement can mark fields to keep out of the permanent ledger record while still available to the parties through the application.
What an auditor or regulator can check
| Question | Where the answer is |
|---|---|
| Who approved this release, and were they allowed to? | The ledger transaction names the approving parties; the contract names who may approve; the quorum is counted on the ledger |
| Did the person really do it, or someone with their login? | The signature from the person’s own key; the evidence record’s authentication method, strength and time |
| Was the company bound, and by whom? | The party bound and the acting person, with the on-ledger assignment relied on |
| Was anyone approving their own payment? | The roles in the contract and the identity links between parties and people |
| Is this the agreement they signed? | The signed version fingerprints carried with the contract, re-verifiable offline |
| Did the platform, or an administrator, act for a party? | Platform actions are limited to signed mandates and recorded as such; administrator credentials can’t transact |
| Has the record been altered? | Each party holds its own ledger copy; evidence records and key-use logs are write-once and reconciled |
Reserve attestation follows the same principle: the platform’s automated reconciliation (the Attestation Feed) is evidence, and a reserve snapshot counts only once an independent, licensed auditor countersigns it on the ledger.