{"templateId":"markdown","versions":[{"version":"v1.43","label":"v1.43 LTS","link":"/products/custody/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.42","label":"v1.42 STS","link":"/products/custody/v1.42/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.41","label":"v1.41 STS","link":"/products/custody/v1.41/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Architecture and responsibilities","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"architecture-and-responsibilities","__idx":0},"children":["Architecture and responsibilities"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," supports Canton through a ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["bring your own validator"]}," (BYOV) model. You or a node provider that you contract operate the Canton validator. ","Ripple Custody"," connects to that validator and manages your parties."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In Canton Network terms, Ripple fills the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.canton.network/global-synchronizer/understand/validator-roles#party-management"},"children":["Party Management"]}," role, and you or your node provider fill the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.canton.network/global-synchronizer/understand/validator-roles"},"children":["Validator Operator"]}," role."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"architecture","__idx":1},"children":["Architecture"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n subgraph Custody[\"Ripple Custody\"]\n Core[\"Core and policy engine\"]\n Vault[\"Vault
(HSM or KMS)\"]\n UIS[\"Unified Indexer Service v2
(Canton indexer)\"]\n end\n subgraph Customer[\"You or your node provider\"]\n Validator[\"Canton validator
(Splice Validator App)\"]\n ValParty[\"Validator service party
(validator-held key)\"]\n end\n DAR[\"DA Registry\"]\n Net[\"Canton Network
(Global Synchronizer)\"]\n\n Core --> UIS\n Vault -- \"signs for your parties\" --> UIS\n UIS -- \"Ledger API (gRPC)
Validator API (REST)\" --> Validator\n UIS -- \"DA Registry API (REST)\" --> DAR\n Validator --> Net\n ValParty --- Validator\n","diagramHtml":"

You or your node provider

Ripple Custody

signs for your parties

Ledger API (gRPC)
Validator API (REST)

DA Registry API (REST)

Core and policy engine

Vault
(HSM or KMS)

Unified Indexer Service v2
(Canton indexer)

Canton validator
(Splice Validator App)

Validator service party
(validator-held key)

DA Registry

Canton Network
(Global Synchronizer)

","diagramHtmlDark":"

You or your node provider

Ripple Custody

signs for your parties

Ledger API (gRPC)
Validator API (REST)

DA Registry API (REST)

Core and policy engine

Vault
(HSM or KMS)

Unified Indexer Service v2
(Canton indexer)

Canton validator
(Splice Validator App)

Validator service party
(validator-held key)

DA Registry

Canton Network
(Global Synchronizer)

"},"children":["flowchart LR\n subgraph Custody[\"Ripple Custody\"]\n Core[\"Core and policy engine\"]\n Vault[\"Vault
(HSM or KMS)\"]\n UIS[\"Unified Indexer Service v2
(Canton indexer)\"]\n end\n subgraph Customer[\"You or your node provider\"]\n Validator[\"Canton validator
(Splice Validator App)\"]\n ValParty[\"Validator service party
(validator-held key)\"]\n end\n DAR[\"DA Registry\"]\n Net[\"Canton Network
(Global Synchronizer)\"]\n\n Core --> UIS\n Vault -- \"signs for your parties\" --> UIS\n UIS -- \"Ledger API (gRPC)
Validator API (REST)\" --> Validator\n UIS -- \"DA Registry API (REST)\" --> DAR\n Validator --> Net\n ValParty --- Validator\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you submit a Canton transaction order:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ","Ripple Custody"," policy engine evaluates the intent and collects approvals, as on every other ledger."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The Canton indexer prepares the transaction on your validator."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The vault decodes the prepared transaction and checks it against the approved intent. For a transfer, it checks the receiver, amount, and instrument. For an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Accept"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Reject"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Withdraw"]},", it checks the exact contract ID. For every operation, it checks the synchronizer ID. If anything doesn't match, the vault refuses to sign."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The vault signs with the account's Ed25519 key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The indexer submits the signed transaction through your validator."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The indexer observes the committed update and marks the transaction as confirmed."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each intent results in one prepared transaction, one vault signature, and one submission."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deployment-models","__idx":2},"children":["Deployment models"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ","Ripple Custody"," deployment model and the validator model are independent. In every deployment model, you provide the validator."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Deployment"},"children":["Deployment"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Who runs Ripple Custody"},"children":["Who runs ","Ripple Custody"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Who runs the Canton indexer"},"children":["Who runs the Canton indexer"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Validator network access"},"children":["Validator network access"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Hybrid"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple (SaaS) or you"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple, as a dedicated indexer instance connected to your validator"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Allow the Ripple indexer IP addresses through your validator firewall."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["On-premises"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["You"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["You, as part of your Custodian Helm installation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The indexer connects from inside your network."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SaaS customers use Canton through the hybrid model only. Ripple runs a dedicated Canton indexer for your validator. ","Ripple Custody"," doesn't offer a shared Canton indexer."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the hybrid model, your indexer instance can reach only your own validator."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the environment requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/accounts-and-assets/blockchains/canton/connect-your-validator#validator-prerequisites"},"children":["Validator prerequisites"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"shared-responsibilities","__idx":3},"children":["Shared responsibilities"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Responsibility"},"children":["Responsibility"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"You or your node provider"},"children":["You or your node provider"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Ripple"},"children":["Ripple"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Operate, secure, and monitor the validator node"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keep the Splice Validator App on the latest release"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install and update the DARs for the CIP-56 tokens that you hold"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provide Ledger API, Validator API, and DA Registry API endpoints over TLS, with credentials"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant the Ledger API user rights that ","Ripple Custody"," needs"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keep a Canton Coin balance on the validator operator party for network fees"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Hold the validator service party key, and collect validator rewards"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Move rewards from the validator service party to a ","Ripple Custody"," account, if you want them in custody"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Allow the Ripple indexer IP addresses through your firewall (hybrid)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provision and operate the Canton indexer (hybrid)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provision and operate the Canton indexer (on-premises)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configure the validator endpoints and credentials in ","Ripple Custody"," (hybrid)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provide them to Ripple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Configure the validator endpoints and credentials in ","Ripple Custody"," (on-premises)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Register the Canton ledger and tickers with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateLedger"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_ValidateTickers"]}," intents"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Generate and protect each account's Ed25519 party key in your vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes, through your vault's HSM or KMS"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check every transaction against its approved intent before signing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Apply your policies, approvals, quarantine rules, and audit trail to Canton operations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Index balances and transaction history"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Migrate parties from another custodian"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Yes, if applicable: create new ","Ripple Custody"," parties, transfer the balances, and retire the old parties"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-model","__idx":4},"children":["Security model"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Ripple Custody"," doesn't run validator infrastructure and doesn't hold validator keys."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your validator hosts your parties but doesn't hold their signing keys. It can't move your ","Ripple Custody"," assets without a signature from your vault."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The validator service party's key stays with the validator, because the Canton Network requires it to sign autonomously for traffic top-ups, reward collection, and pre-approval renewals. This key doesn't control any ","Ripple Custody"," account, and running a validator doesn't put ","Ripple Custody"," assets at risk. It does mean that you or your node provider keep an operational signing responsibility outside ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A policy-approved ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_CreateLedger"]}," intent sets the validator operator party, the DSO party, and the DA Registry operator once. ","Ripple Custody"," stores these values in its trusted collections and reads them back for every later check, instead of fetching them again from the network."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the BYOV model, account data sits on your validator, which puts data residency under your control."]}]}]},"headings":[{"value":"Architecture and responsibilities","id":"architecture-and-responsibilities","depth":1},{"value":"Architecture","id":"architecture","depth":2},{"value":"Deployment models","id":"deployment-models","depth":2},{"value":"Shared responsibilities","id":"shared-responsibilities","depth":2},{"value":"Security model","id":"security-model","depth":2}],"frontmatter":{"seo":{"title":"Architecture and responsibilities"}},"lastModified":"2026-10-23T14:40:24.137Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/accounts-and-assets/blockchains/canton/architecture-and-responsibilities","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}