Skip to main content
TSN is an identity-first, intent-based, privacy-preserving settlement layer for stablecoin and digital asset transfers, running on Solana. Its architecture is organized into five layers that take a transfer from identity resolution through to privacy-preserving on-chain settlement. Each layer has a narrow responsibility, and data moves between layers through well-defined commitments and signatures rather than plaintext on-chain records.

​
Identity layer

The identity layer resolves human-meaningful payment identities without exposing them on-chain in plaintext. A Transfer Identity Number (TIN) maps to routing metadata through a GPRU (Geographic/Private Routing Unit), keeping the actual identity and routing details off-chain. Only commitments and derived PDAs reach the Solana ledger.

​
Intent layer

Payment intents are signed off-chain. Each intent binds recipient, amount, mint, nonce, and a validity window to the sender’s TIN. Because the intent lives off-chain until authorization, sensitive terms are not visible on-chain until settlement. Intents are the atomic unit of payment agreement in TSN.

​
Authorization layer

The Mother Escrow is the root TSN authority and epoch controller. It is a PDA whose stored authority is a governed external keypair. The Mother authorizes intent acceptance and produces Settlement DNA, which binds payout parameters (recipient, amount, mint, nonce, digest, expiry) to an opaque slot. A permit signer then authorizes the actual private-settlement payout using domain-separated Ed25519 templates. The permit signer is governance-rotatable and signs only these templates.

​
Transport layer

The transport layer is split across three roles with no single point of signing authority:
  • Node: a stateless off-chain verifier that checks canonical route messages, route/device/wallet signatures, device key fingerprints, expiration, nonces, and commitment field structure. Nodes have no signing authority. Their attestations are off-chain evidence.
  • Receiver: durable infrastructure for verified work state. It stores and leases work, authenticates Crankers, enforces state versions, and provides wake notifications. It does not create authorization.
  • Cranker: transports the exact authorized transaction and pays fees. It cannot change recipient, mint, amount, settlement commitment, nonce, nullifier, or Settlement DNA. It is trusted only for liveness and correct submission.

​
Settlement layer

The Epoch Treasury holds epoch-level source liquidity and liabilities. Treasury and vault accounting keep settled funds separate from pending obligations. TCAP (Transfer Confidential Accounting Protocol) records private balance transitions using commitments and encrypted snapshots. Owners can decrypt their own snapshots, giving TSN confidential balance accounting and tip credits.

​
Layer summary

For more on how trust is distributed across these layers, see the Trust Model. To understand why authorization and transport are separated, read Separation of Concerns. For details on confidential accounting, see TCAP.