A vault keeps your records provable to you. A commons lets a whole group ask questions across each other’s vaults — and get a provable answer — without any record ever leaving any building.
A vault is your private records. The commons is how vaults ask across each other — without opening. Everyone already knows both words; the pairing explains itself. The vault is the node; the commons is the network between nodes.
“Across our 40 credit unions, how many members have exposure over $X to counterparty Y?”
Every vault computes its own number over its own records. That number never leaves the building.
Each vault sends a masked contribution — it reveals no member, no record, not even its own count.
The answer is combined and proven correct — and a vault that tries to poison or inflate it is rejected.
A provable answer over the whole group, with no member and no institution’s number ever exposed. The sovereignty that sold the vault stays intact.
A vault is valuable alone; connected vaults are worth more to each other. Leaving means leaving the network — a good product becomes an uncopyable moat.
A fraud or ransomware signature seen at one vault can warn the whole network — while the underlying records stay put.
A regulator gets a verifiable aggregate answer from the group, without any member surrendering its records.
Consent per member: a vault only joins questions its owner agreed to, and every question is named and logged.
A question must draw on enough distinct vaults that no group can isolate a single institution’s answer.
A privacy budget caps what any run of questions can reveal. When it’s spent, the questions stop.
Every contribution is checked; a vault that tries to poison or inflate the total is rejected — not quietly averaged in.
Honest bound: collusion is bounded, not impossible — the independence gate and the privacy budget are the limits, and the group sets them together.
The commons is a network subscription across the whole group — sold to the organizing body, not one buyer. It turns single‑box deals into a network, and it’s the stickiest thing we offer: leaving means leaving the network.
Priced against the shared systems it replaces — a central data lake, a cross‑institution reporting utility, a shared fraud/AML service — all of which it does without centralizing anyone’s data.
Ship the box first — the easy win. Then connect a small group and ask across all of them, with nothing leaving any building. Let’s scope the first consortium.