First vertical
Merchant acquiring & PSP routing
Institutional merchant-services and payment-processing deals still run on handshakes, forwarded intros, and broker chains arguing over basis points. TOL turns that into structured market infrastructure — visible at the market level, private at the deal level.
Your relationships are already assets. Sealing one doesn't mean handing it over — it means putting it to work.The Lockbox thesis
How it works
A viewer only ever gets as much of a counterparty's reality as their role, purpose, and the current disclosure level allow. Each layer adds trust the next one depends on.
Browse anonymized supply and demand. A listing card never implies permission to expose the record behind it — field-level permissions are enforced by the server, not hidden by the screen.
visible at market level · private at deal level
A portable, reusable record of institutional financial health — facts, evidence, verification, freshness — built once and reused across counterparties, instead of re-proving yourself from scratch on every deal.
portable trust · provenance · freshness
Seal a sensitive relationship before you disclose it — encrypted, receipted, withdrawable — and earn durable, disputable credit for the value you bring, without ever claiming ownership of someone else's business.
seal without exposing · fair credit by history + proximity + evidence + time
Deterministic eligibility, explainable ranking, a versioned RFQ and quote, and a private deal room with conditions, decisions, and an immutable timeline — the handshake, made auditable.
eligibility → ranking → private RFQ → deal room → activation
Why this order matters. You can't run a private match on parties you can't trust, can't trust parties without portable provenance, and can't get honest provenance if contributing a relationship means giving it away. Each layer removes a reason the market stays informal.
Not a mockup — a working system
TOL is being built as a working, tested platform under a gated methodology (21 release gates, P0–P20) designed to survive independent re-evaluation. Status below is verified, not asserted.
Auth & tenant isolation, RFQ, deal room, the Lockbox, attribution, marketplace, passport — each reproduced from a clean build and checked, not taken on a builder's word.
AES-256-GCM envelope encryption + Shamir 2-of-3 threshold key custody + signed receipts. The Lockbox stores genuine ciphertext; sealed content is provably tamper-evident, withdrawable, and never persisted in plaintext.
Proven against the raw API response: a market-level viewer cannot retrieve deal-private fields — rates, exact volumes, counterparty identities. Redaction happens on the server before the bytes leave it.
Attribution and matching produce the same result every time from the same inputs, with a per-factor breakdown and version stamps. No statistical model deciding who gets credit or who gets matched.
Every restricted action is reconstructable from an append-only log; tenant isolation is proven three independent ways. The record is built to be inspected.
The hard, high-risk parts are done first, on purpose. The cryptography is real, the permissions are server-enforced, and the scoring is deterministic — the three things a pretty demo usually fakes are exactly the three already proven here.