Security
The operator is
not a trusted party.
Most platforms ask you to trust the company running them. This one is built so that you do not have to. The desk cannot read your documents, cannot move your money, cannot take your title and cannot alter a record after the fact — not as a matter of policy, but because it never holds what would be required.
01
What UIE never holds
No client money
Payment runs between the parties and their banks, under a letter of credit or an escrow with a named agent. No UIE account sits in the path, so there is nothing to freeze, misapply or lose.
No title
Title moves between the parties — by electronic bill of lading for cargo, by a signed transfer instrument for a registered asset. The desk is refused by its own gate if it attempts to take title, and the refusal is written to the deal's chain.
No document keys
Every document is encrypted to the parties entitled to read it. The operator is never among the recipients; an upload that names the operator as one is rejected outright. Whoever reaches the storage finds ciphertext.
02
How it actually works
Keys belong to people, not to accounts
Each person holds an Ed25519 signing key and an X25519 key for receiving documents. Keys are generated in the browser. There are no shared logins: an instruction is signed by a named individual, under a mandate their own firm issued them, or it does not happen.
Every action is gated, and every decision is receipted
A state-changing call passes a gate that checks the role, the freshness of the counterparty's verification, the mandate and its limits, whether a second pair of eyes is required, and whether the same person is trying to do both halves of a two-person job. The answer is allow, step up or deny. All three are receipted — refusals are kept, not discarded, because a refusal is often the thing you need to prove later.
Receipts are chained, not merely stored
Each receipt carries the hash of the one before it, so the sequence cannot be reordered, and nothing can be inserted or quietly removed without the chain failing. A witness counter-signs the head of each chain. Deleting a receipt is as detectable as altering one.
Access is granted for a purpose and expires on its own
A bank, inspector, agent or insurer is given the documents the job needs, for as long as it needs them. Access is scoped per transaction and per document, it lapses without anyone remembering to revoke it, and every time someone opens your file you can see who, when and why.
Revocation takes effect at once
Withdraw a mandate and the work stops in the same request cycle — open cases go on hold, the desk's access to the files ends, and anything already signed stays signed and stays provable. There is no window in which a former trader can still commit you.
Records are held in the European Union
Storage is in Frankfurt and stays there. You can export everything you are party to at any time, in a format that verifies without us.
03
Check it yourself
The strongest claim here is the one you can test: an evidence pack verifies on its own, with no call to UIE and no cooperation from us. There is a page for that, with a real pack to try it on.
Verify a pack Read the assurance report
This is a proof of concept run for a small number of principals. The engine, the keys and the checks are real; parts of the world around them are still simulated. The assurance report says exactly where that line falls — including that the witness key is development-only and that a qualified timestamping authority is needed before live transactions.