{"templateId":"markdown","versions":[{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/overview/architecture","default":true,"active":true,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/overview/architecture","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/overview/architecture","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/overview/architecture","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/overview/architecture","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/overview/architecture","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"System architecture","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"system-architecture","__idx":0},"children":["System architecture"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Executive summary"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Ripple Custody"," separates interaction services, asynchronous workflows, and isolated signing boundaries."]}," Users, applications, and services submit requests through the interaction layer. The platform accepts mutation requests for asynchronous processing, runs the relevant workflow state machine, evaluates policy, persists operational state, and uses protected signing components only through narrow interfaces."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mutation requests use intents"]},": Administrative changes, account and vault changes, endpoint updates, transaction orders, and compliance operations enter the governed workflow as intents."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API intake is asynchronous"]},": Intent proposal, approval, and rejection calls return ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["202 Accepted"]}," when the request is accepted for processing. The workflow then continues through queued SAGA-style state transitions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sensitive operations run in protected boundaries"]},": The notary evaluates policy and protects trusted state. The vault independently verifies notary attestations before signing blockchain transactions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Private keys stay protected"]},": User keys, notary keys, vault keys, Gateway system-signing keys where enabled, and blockchain signing keys stay outside general application services."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Operational dependencies are explicit"]},": PostgreSQL, AMQP, blockchain nodes, certificates, secrets, KMS/HSM/MPC backends, and identity providers provide the operating foundation."]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"success","name":"Why this matters"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Architecture decisions in ","Ripple Custody"," directly affect asset safety, recovery, auditability, and operational resilience. Use this page to understand the main components, trust boundaries, runtime flows, and design questions before you plan deployment, governance, key management, or integrations."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"architectural-principles","__idx":1},"children":["Architectural principles"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Principle"},"children":["Principle"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What it means"},"children":["What it means"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Governed by default"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domain, user, policy, vault, account, endpoint, transaction order, and compliance mutation operations use the intent workflow."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Asynchronous request-response"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API calls that start governed work accept the request, return a request ID, and let the workflow state machine complete the work asynchronously."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Narrow protected boundary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy evaluation, trusted-state attestation, and raw blockchain transaction signing happen only inside protected notary and vault boundaries."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Isolated key material"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS, HSM, or MPC systems perform sensitive key operations. General application services do not receive private keys."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verifiable state"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Database records, queued work, and service outputs are not trusted by placement alone. Trusted state and signing operations are checked with cryptographic controls."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Explicit dependencies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure services are part of the runtime system boundary, but deployment topics cover how those services are hosted and operated."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"logical-architecture","__idx":2},"children":["Logical architecture"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform is easier to reason about as five cooperating areas:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Interaction and identity"]},": Web UI, API clients, service callers, GraphQL, API Gateway, identity provider, and notifications."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workflow and accounting"]},": AMQP-backed workflow state machines, Approval/Notary Bridge, Ledger Accounting, and Event Processing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protected trust boundary"]},": Notary, vault, cold vault bridge, KMS Connect, and KMS/HSM/MPC backends."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Blockchain integration"]},": Ledger APIs, adapters, processors, blockchain indexing services, and blockchain nodes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Infrastructure dependencies"]},": PostgreSQL, AMQP broker, certificates, secrets, container registry, blockchain nodes, and external providers."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A useful mental model is \"user space\" and \"kernel space.\" Most platform services run in user space: they authenticate users, accept API calls, queue work, display data, and coordinate workflows. Sensitive security operations run in kernel space: policy evaluation and trusted-state attestation in the notary, and raw blockchain transaction signing in the vault. The interface between the two areas is intentionally narrow and cryptographically checked."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TB\n subgraph callers[\"Users, apps, and service callers\"]\n ui[\"Web UI\"]\n apiClients[\"API clients\"]\n serviceCallers[\"Service callers\"]\n authSign[\"Auth and Sign app\"]\n end\n\n subgraph interaction[\"Interaction and identity\"]\n gateway[\"API Gateway\"]\n graphql[\"GraphQL\"]\n idp[\"OIDC / Keycloak / external IdP\"]\n notify[\"Notifications and core extensions\"]\n end\n\n subgraph workflow[\"Workflow and accounting\"]\n amqp[\"AMQP broker\"]\n workflows[\"Intent workflow state machines\"]\n bridge[\"Approval / Notary Bridge\"]\n accounting[\"Ledger Accounting\"]\n eventProcessing[\"Event Processing\"]\n end\n\n subgraph data[\"State and queues\"]\n postgres[(\"PostgreSQL\")]\n end\n\n subgraph protected[\"Protected trust boundary\"]\n notary[\"Notary / policy evaluation\"]\n notaryKms[\"Notary KMS Connect\"]\n vault[\"Vault\"]\n vaultBridge[\"Vault Bridge / Cold Bridge\"]\n vaultKms[\"Vault KMS Connect\"]\n kms[\"KMS / HSM / MPC\"]\n end\n\n subgraph blockchain[\"Blockchain integration\"]\n indexing[\"Blockchain indexing services\"]\n ledgerApis[\"Ledger APIs and adapters\"]\n nodes[\"Blockchain nodes\"]\n end\n\n subgraph external[\"External integrations\"]\n compliance[\"Compliance providers\"]\n webhooks[\"Webhook receivers\"]\n end\n\n ui --> gateway\n ui --> graphql\n authSign --> idp\n apiClients --> gateway\n serviceCallers --> gateway\n gateway --> idp\n graphql --> gateway\n notify --> ui\n gateway --> amqp\n amqp --> workflows\n workflows --> bridge\n bridge <--> notary\n notary <--> notaryKms\n notaryKms <--> kms\n workflows --> accounting\n workflows --> eventProcessing\n accounting --> postgres\n eventProcessing --> postgres\n gateway <--> vault\n vault <--> vaultKms\n vaultKms <--> kms\n vaultBridge <--> vault\n accounting <--> indexing\n indexing <--> ledgerApis\n ledgerApis <--> nodes\n accounting <--> compliance\n eventProcessing --> webhooks\n","diagramHtml":"

External integrations

Blockchain integration

Protected trust boundary

State and queues

Workflow and accounting

Interaction and identity

Users, apps, and service callers

Web UI

API clients

Service callers

Auth and Sign app

API Gateway

GraphQL

OIDC / Keycloak / external IdP

Notifications and core extensions

AMQP broker

Intent workflow state machines

Approval / Notary Bridge

Ledger Accounting

Event Processing

PostgreSQL

Notary / policy evaluation

Notary KMS Connect

Vault

Vault Bridge / Cold Bridge

Vault KMS Connect

KMS / HSM / MPC

Blockchain indexing services

Ledger APIs and adapters

Blockchain nodes

Compliance providers

Webhook receivers

","diagramHtmlDark":"

External integrations

Blockchain integration

Protected trust boundary

State and queues

Workflow and accounting

Interaction and identity

Users, apps, and service callers

Web UI

API clients

Service callers

Auth and Sign app

API Gateway

GraphQL

OIDC / Keycloak / external IdP

Notifications and core extensions

AMQP broker

Intent workflow state machines

Approval / Notary Bridge

Ledger Accounting

Event Processing

PostgreSQL

Notary / policy evaluation

Notary KMS Connect

Vault

Vault Bridge / Cold Bridge

Vault KMS Connect

KMS / HSM / MPC

Blockchain indexing services

Ledger APIs and adapters

Blockchain nodes

Compliance providers

Webhook receivers

"},"children":["flowchart TB\n subgraph callers[\"Users, apps, and service callers\"]\n ui[\"Web UI\"]\n apiClients[\"API clients\"]\n serviceCallers[\"Service callers\"]\n authSign[\"Auth and Sign app\"]\n end\n\n subgraph interaction[\"Interaction and identity\"]\n gateway[\"API Gateway\"]\n graphql[\"GraphQL\"]\n idp[\"OIDC / Keycloak / external IdP\"]\n notify[\"Notifications and core extensions\"]\n end\n\n subgraph workflow[\"Workflow and accounting\"]\n amqp[\"AMQP broker\"]\n workflows[\"Intent workflow state machines\"]\n bridge[\"Approval / Notary Bridge\"]\n accounting[\"Ledger Accounting\"]\n eventProcessing[\"Event Processing\"]\n end\n\n subgraph data[\"State and queues\"]\n postgres[(\"PostgreSQL\")]\n end\n\n subgraph protected[\"Protected trust boundary\"]\n notary[\"Notary / policy evaluation\"]\n notaryKms[\"Notary KMS Connect\"]\n vault[\"Vault\"]\n vaultBridge[\"Vault Bridge / Cold Bridge\"]\n vaultKms[\"Vault KMS Connect\"]\n kms[\"KMS / HSM / MPC\"]\n end\n\n subgraph blockchain[\"Blockchain integration\"]\n indexing[\"Blockchain indexing services\"]\n ledgerApis[\"Ledger APIs and adapters\"]\n nodes[\"Blockchain nodes\"]\n end\n\n subgraph external[\"External integrations\"]\n compliance[\"Compliance providers\"]\n webhooks[\"Webhook receivers\"]\n end\n\n ui --> gateway\n ui --> graphql\n authSign --> idp\n apiClients --> gateway\n serviceCallers --> gateway\n gateway --> idp\n graphql --> gateway\n notify --> ui\n gateway --> amqp\n amqp --> workflows\n workflows --> bridge\n bridge <--> notary\n notary <--> notaryKms\n notaryKms <--> kms\n workflows --> accounting\n workflows --> eventProcessing\n accounting --> postgres\n eventProcessing --> postgres\n gateway <--> vault\n vault <--> vaultKms\n vaultKms <--> kms\n vaultBridge <--> vault\n accounting <--> indexing\n indexing <--> ledgerApis\n ledgerApis <--> nodes\n accounting <--> compliance\n eventProcessing --> webhooks\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"trust-and-responsibility-boundaries","__idx":3},"children":["Trust and responsibility boundaries"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," uses a zero-trust model. In this context, \"trusted\" does not mean \"important.\" It means a component is part of the cryptographic boundary that prevents unauthorized trusted-state changes or unauthorized transaction signing."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Boundary"},"children":["Boundary"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Includes"},"children":["Includes"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Role"},"children":["Role"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Design question"},"children":["Design question"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client and interaction boundary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Web UI, API clients, service callers, API Gateway, GraphQL, identity provider, notification services"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authenticates callers, accepts requests, exposes data, and routes work. These services do not make a state mutation trusted by themselves."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which users, service callers, tokens, certificates, and ingress paths are allowed?"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow and accounting boundary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AMQP workflows, Approval/Notary Bridge, Ledger Accounting, Event Processing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Runs workflow state machines, coordinates approvals, accounts for balances, persists operational state, and processes events."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which components must be singleton, horizontally scaled, or monitored for backlog?"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protected trust boundary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notary, vault, KMS Connect, KMS/HSM/MPC, Vault Bridge or Cold Bridge"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Evaluates policies, protects trusted state, validates signatures, prevents state rewind, and signs blockchain transactions only after vault verification of notary attestation."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Where do notary, vault, and KMS run, and how are they isolated from workflow and interaction services?"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure dependencies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL, AMQP broker, blockchain nodes, secrets, certificates, registry, network routes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provides persistence, messaging, ledger access, and operational security."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Which dependencies must be available for each runtime flow?"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["External integration boundary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Compliance providers, webhook receivers, third-party node providers, corporate proxies"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Extends the platform to screening, event delivery, or ledger connectivity outside the platform."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["What happens when an external provider is unavailable, slow, or misconfigured?"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the detailed security model, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security-model"},"children":["Security model"]},". For HA, DR, and ownership categories, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/resilience"},"children":["Resilience planning"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"deployment-models-who-runs-what","__idx":4},"children":["Deployment models: who runs what"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," runs in three deployment models. The trust boundaries above are the same in all three; what changes is who deploys and operates each component. In both SaaS models, the customer keeps operating the key-material side of the protected trust boundary, so neither party can sign transactions alone."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Component"},"children":["Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"On-premises"},"children":["On-premises"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"SaaS (Vault with HSM)"},"children":["SaaS (Vault with HSM)"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"SaaS (MPC)"},"children":["SaaS (MPC)"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Core platform services (API gateway, workflows, accounting, notary, event processing)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Web and API applications"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Blockchain indexers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL and AMQP broker"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault and KMS Connect"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS/HSM backend"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not used; MPC key management replaces the HSM"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC Nodes 0 and 1, Relay Server"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not applicable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not applicable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ripple"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MPC Nodes 2 and 3"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not applicable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Not applicable"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer"]}]}]}]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["On-premises"]},": you deploy and operate the full stack in your own infrastructure."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SaaS (Vault with HSM)"]},": Ripple hosts the platform; you deploy and operate the vault, KMS Connect, and the HSM that holds your key material in your own environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SaaS (MPC)"]},": Ripple hosts the platform, the vault, MPC Nodes 0 and 1, and the Relay Server; you deploy and operate MPC Nodes 2 and 3 in your own infrastructure. Signing uses a 3-of-4 threshold across the four nodes, so neither party can sign alone. See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/mpc/overview"},"children":["MPC overview"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"runtime-flows","__idx":5},"children":["Runtime flows"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"governed-state-mutation","__idx":6},"children":["Governed state mutation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Most administrative and operational changes use the same intent lifecycle: submit, accept for asynchronous processing, evaluate policy, collect approvals where required, execute the relevant workflow transition, and record auditable state."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant Caller as User or service caller\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Workflow as Workflow state machine\n participant Notary as Notary / policy evaluation\n participant KMS as Notary KMS\n participant Accounting as Ledger Accounting\n participant DB as PostgreSQL\n\n Caller->>API: Submit signed intent\n API->>API: Validate JWT and request shape\n API-->>Caller: 202 Accepted with requestId\n API->>AMQP: Queue workflow task\n AMQP-->>Workflow: Start intent workflow\n Workflow->>Notary: Evaluate policy and trusted state\n Notary->>Notary: Verify signatures, Merkle state, and ARF\n Notary->>KMS: Sign root or attestation\n KMS-->>Notary: Return signature\n Notary-->>Workflow: Return decision and signed trusted-state result\n Workflow->>Accounting: Continue workflow and persist result\n Accounting->>DB: Write operational state and audit records\n Caller->>API: Poll request or intent state\n","diagramHtml":"PostgreSQLLedger AccountingNotary KMSNotary / policy evaluationWorkflow state machineAMQP brokerAPI GatewayUser or service callerPostgreSQLLedger AccountingNotary KMSNotary / policy evaluationWorkflow state machineAMQP brokerAPI GatewayUser or service callerSubmit signed intentValidate JWT and request shape202 Accepted with requestIdQueue workflow taskStart intent workflowEvaluate policy and trusted stateVerify signatures, Merkle state, and ARFSign root or attestationReturn signatureReturn decision and signed trusted-state resultContinue workflow and persist resultWrite operational state and audit recordsPoll request or intent state","diagramHtmlDark":"PostgreSQLLedger AccountingNotary KMSNotary / policy evaluationWorkflow state machineAMQP brokerAPI GatewayUser or service callerPostgreSQLLedger AccountingNotary KMSNotary / policy evaluationWorkflow state machineAMQP brokerAPI GatewayUser or service callerSubmit signed intentValidate JWT and request shape202 Accepted with requestIdQueue workflow taskStart intent workflowEvaluate policy and trusted stateVerify signatures, Merkle state, and ARFSign root or attestationReturn signatureReturn decision and signed trusted-state resultContinue workflow and persist resultWrite operational state and audit recordsPoll request or intent state"},"children":["sequenceDiagram\n participant Caller as User or service caller\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Workflow as Workflow state machine\n participant Notary as Notary / policy evaluation\n participant KMS as Notary KMS\n participant Accounting as Ledger Accounting\n participant DB as PostgreSQL\n\n Caller->>API: Submit signed intent\n API->>API: Validate JWT and request shape\n API-->>Caller: 202 Accepted with requestId\n API->>AMQP: Queue workflow task\n AMQP-->>Workflow: Start intent workflow\n Workflow->>Notary: Evaluate policy and trusted state\n Notary->>Notary: Verify signatures, Merkle state, and ARF\n Notary->>KMS: Sign root or attestation\n KMS-->>Notary: Return signature\n Notary-->>Workflow: Return decision and signed trusted-state result\n Workflow->>Accounting: Continue workflow and persist result\n Accounting->>DB: Write operational state and audit records\n Caller->>API: Poll request or intent state\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User-signed intents include a user author and a client-side signature. API-only system-signed proposals omit the user author and client-side payload signature; the Gateway signs them internally only when system-signed intent processing, trusted public key registration, and matching ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SystemSigned"]}," policies are in place. For the request structures, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/intents/intent-request-structure"},"children":["Intent request structure"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"outgoing-transaction","__idx":7},"children":["Outgoing transaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Outgoing blockchain transactions add an attestation, signing, and broadcast phase after governance approval. The notary does not push a signing order to the vault. The vault independently polls for work, verifies the notary attestation and request data, builds the ledger-specific transaction, and asks its KMS backend for the protected signing operation."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant Caller as User or service caller\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Bridge as Approval / Notary Bridge\n participant Notary\n participant NotaryKMS as Notary KMS\n participant Vault\n participant VaultKMS as Vault KMS\n participant Accounting as Ledger Accounting\n participant Node as Blockchain node\n participant Indexing as Blockchain indexing services\n\n Caller->>API: Submit transaction intent\n API-->>Caller: 202 Accepted with requestId\n API->>AMQP: Publish workflow task\n Bridge->>AMQP: Consume workflow task\n Notary->>Bridge: Poll for signed request and approvals\n Bridge-->>Notary: Return request data\n Notary->>Notary: Verify signatures, evaluate policy, update Merkle state\n Notary->>NotaryKMS: Sign attestation\n NotaryKMS-->>Notary: Return signature\n Notary-->>Bridge: Return attested operation\n Bridge->>AMQP: Publish attested result\n Vault->>API: Poll for attested operation\n API-->>Vault: Return operation and notary attestation\n Vault->>Vault: Verify attestation, Merkle proof, and request\n Vault->>VaultKMS: Request protected transaction signature\n VaultKMS-->>Vault: Return signature only\n Vault-->>API: Submit signed blockchain transaction\n API->>Accounting: Queue broadcast and tracking\n Accounting->>Node: Broadcast signed transaction\n Indexing->>Node: Observe ledger state\n Accounting->>Indexing: Pull status or events\n Indexing-->>Accounting: Return detection and confirmations\n","diagramHtml":"Blockchain indexing servicesBlockchain nodeLedger AccountingVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayUser or service callerBlockchain indexing servicesBlockchain nodeLedger AccountingVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayUser or service callerSubmit transaction intent202 Accepted with requestIdPublish workflow taskConsume workflow taskPoll for signed request and approvalsReturn request dataVerify signatures, evaluate policy, update Merkle stateSign attestationReturn signatureReturn attested operationPublish attested resultPoll for attested operationReturn operation and notary attestationVerify attestation, Merkle proof, and requestRequest protected transaction signatureReturn signature onlySubmit signed blockchain transactionQueue broadcast and trackingBroadcast signed transactionObserve ledger statePull status or eventsReturn detection and confirmations","diagramHtmlDark":"Blockchain indexing servicesBlockchain nodeLedger AccountingVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayUser or service callerBlockchain indexing servicesBlockchain nodeLedger AccountingVault KMSVaultNotary KMSNotaryApproval / Notary BridgeAMQP brokerAPI GatewayUser or service callerSubmit transaction intent202 Accepted with requestIdPublish workflow taskConsume workflow taskPoll for signed request and approvalsReturn request dataVerify signatures, evaluate policy, update Merkle stateSign attestationReturn signatureReturn attested operationPublish attested resultPoll for attested operationReturn operation and notary attestationVerify attestation, Merkle proof, and requestRequest protected transaction signatureReturn signature onlySubmit signed blockchain transactionQueue broadcast and trackingBroadcast signed transactionObserve ledger statePull status or eventsReturn detection and confirmations"},"children":["sequenceDiagram\n participant Caller as User or service caller\n participant API as API Gateway\n participant AMQP as AMQP broker\n participant Bridge as Approval / Notary Bridge\n participant Notary\n participant NotaryKMS as Notary KMS\n participant Vault\n participant VaultKMS as Vault KMS\n participant Accounting as Ledger Accounting\n participant Node as Blockchain node\n participant Indexing as Blockchain indexing services\n\n Caller->>API: Submit transaction intent\n API-->>Caller: 202 Accepted with requestId\n API->>AMQP: Publish workflow task\n Bridge->>AMQP: Consume workflow task\n Notary->>Bridge: Poll for signed request and approvals\n Bridge-->>Notary: Return request data\n Notary->>Notary: Verify signatures, evaluate policy, update Merkle state\n Notary->>NotaryKMS: Sign attestation\n NotaryKMS-->>Notary: Return signature\n Notary-->>Bridge: Return attested operation\n Bridge->>AMQP: Publish attested result\n Vault->>API: Poll for attested operation\n API-->>Vault: Return operation and notary attestation\n Vault->>Vault: Verify attestation, Merkle proof, and request\n Vault->>VaultKMS: Request protected transaction signature\n VaultKMS-->>Vault: Return signature only\n Vault-->>API: Submit signed blockchain transaction\n API->>Accounting: Queue broadcast and tracking\n Accounting->>Node: Broadcast signed transaction\n Indexing->>Node: Observe ledger state\n Accounting->>Indexing: Pull status or events\n Indexing-->>Accounting: Return detection and confirmations\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hot vaults perform the vault signing steps online. Cold vaults replace the online vault polling and upload steps with an operator-mediated air-gapped flow. For status details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/transactions/processing"},"children":["Transaction status"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"incoming-and-indexed-activity","__idx":8},"children":["Incoming and indexed activity"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Incoming transfers and on-chain status updates start from blockchain observation rather than user initiation."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n node[\"Blockchain node\"] --> indexing[\"Blockchain indexing services\"]\n indexing --> indexedData[\"Indexed ledger data\"]\n accounting[\"Ledger Accounting\"] -->|\"Pulls indexed activity\"| indexedData\n indexedData -->|\"Returns ledger events\"| accounting\n accounting --> database[(\"PostgreSQL\")]\n accounting --> events[\"Event Processing\"]\n events --> eventApi[\"Events API\"]\n events --> webhook[\"Webhook delivery\"]\n eventApi --> integrator[\"Customer reconciliation systems\"]\n webhook --> integrator\n","diagramHtml":"

Pulls indexed activity

Returns ledger events

Blockchain node

Blockchain indexing services

Indexed ledger data

Ledger Accounting

PostgreSQL

Event Processing

Events API

Webhook delivery

Customer reconciliation systems

","diagramHtmlDark":"

Pulls indexed activity

Returns ledger events

Blockchain node

Blockchain indexing services

Indexed ledger data

Ledger Accounting

PostgreSQL

Event Processing

Events API

Webhook delivery

Customer reconciliation systems

"},"children":["flowchart LR\n node[\"Blockchain node\"] --> indexing[\"Blockchain indexing services\"]\n indexing --> indexedData[\"Indexed ledger data\"]\n accounting[\"Ledger Accounting\"] -->|\"Pulls indexed activity\"| indexedData\n indexedData -->|\"Returns ledger events\"| accounting\n accounting --> database[(\"PostgreSQL\")]\n accounting --> events[\"Event Processing\"]\n events --> eventApi[\"Events API\"]\n events --> webhook[\"Webhook delivery\"]\n eventApi --> integrator[\"Customer reconciliation systems\"]\n webhook --> integrator\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Indexing services identify ledger activity relevant to custody accounts and normalize chain-specific data. Ledger Accounting pulls indexed events and persists the resulting operational state. Product-level Events API and webhook delivery expose platform events to customer systems. For details, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/architecture/unified-indexer-service"},"children":["Unified Indexer Service"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"component-summary","__idx":9},"children":["Component summary"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Component"},"children":["Component"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Primary role"},"children":["Primary role"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Trust and state model"},"children":["Trust and state model"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Runtime shape"},"children":["Runtime shape"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"More detail"},"children":["More detail"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Web UI"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Back-office interface for operators and administrators."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Interaction layer; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple replicas."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/get-started/use-the-ui"},"children":["Use the UI"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Auth and Sign app"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Stores user signing material and signs UI authentication or intent operations."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Client-side user key holder."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["User device application."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/authentication/ui-authentication"},"children":["Register and log in with the UI"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API Gateway"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Public API entry point for clients and components; validates JWTs and request shape."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Interaction layer; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple replicas."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/get-started/use-the-api"},"children":["Use the API"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["GraphQL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Data layer for Web UI v2."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Interaction layer; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple replicas."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/resilience"},"children":["Resilience planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identity provider"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Issues JWTs for UI, API, and service callers."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Security dependency; configuration-sensitive."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Keycloak or external OIDC provider."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/authentication/overview"},"children":["Authentication"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notification server and core extensions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Delivers WebSocket and email/user-invitation notifications."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Interaction layer; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Multiple replicas where enabled."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/notifications"},"children":["Notifications configuration"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Intent workflow state machines"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Drive asynchronous SAGA-style processing for proposals, approvals, transaction orders, and other mutation operations."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow layer; stores operational progress through Ledger Accounting and PostgreSQL."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Depends on workflow and queue topology."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/governance/intents/manage-intents-and-approvals"},"children":["Manage intents and approvals"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Approval / Notary Bridge"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Moves workflow messages between AMQP-backed services and the notary boundary."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bridge into protected trust boundary; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Singleton."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/reference/kms-notary"},"children":["Notary configuration"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Notary"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Evaluates policies, validates trusted state, signs Merkle roots and trusted-state attestations, and maintains anti-rewind protection."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protected trust boundary; stateful through ARF and append-only trusted-state data. The notary does not write platform state directly to PostgreSQL."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Singleton."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail"},"children":["Data integrity and governance"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Verifies notary attestations, derives account keys, builds ledger-specific transactions, and signs blockchain transactions through KMS/HSM/MPC."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protected trust boundary; stateless at runtime."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Two or more replicas for hot vaults; cold vaults use an air-gapped pattern."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/manage-vaults"},"children":["Manage vaults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Vault Bridge / Cold Bridge"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Supports air-gapped cold vault signing workflows."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secure signing support component."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One per cold vault environment."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/identity-and-access/vault-management/cold-vaults"},"children":["Cold vaults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS Connect"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Connects notary, vault, or Gateway-dedicated system-signing components to a selected KMS backend."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Key-management adapter; private keys remain protected by backend controls."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sidecar or connected service depending on integration."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/integrate-kms/overview"},"children":["KMS integration"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ledger Accounting"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tracks balances, transaction state, ledger-specific processing, compliance-related accounting, and persisted workflow outcomes."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow and accounting layer; operational state in PostgreSQL."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Singleton."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/transactions/overview"},"children":["Transactions and transfers"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Blockchain indexing services"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Monitor blockchain nodes, normalize ledger activity, and expose indexed data that Ledger Accounting consumes."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Blockchain integration; state stored in PostgreSQL or component-specific tables."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One per ledger/network pattern; UIS isolates ledger/network components."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/architecture/unified-indexer-service"},"children":["Unified Indexer Service"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Event Processing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Consumes AMQP messages and performs asynchronous work such as event updates and webhook delivery."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Workflow layer; stateless."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One or more replicas depending on queue setup."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/operations-and-maintenance/events-and-webhooks"},"children":["Events and webhooks"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["AMQP broker"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Queues requests and asynchronous tasks."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure dependency; stateful queues."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Highly available RabbitMQ or compatible AMQP v0.9 broker."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/messaging"},"children":["Message queue planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PostgreSQL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Stores platform state, operational records, indexer state, and wrapped key material where applicable."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Infrastructure dependency; stateful. Trusted-state integrity is verified cryptographically."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Production HA database."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/database"},"children":["Database planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["KMS / HSM / MPC"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Protects cryptographic keys and performs signing or key-generation operations."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Cryptographic dependency."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["HSM HA cluster, cloud HSM, or MPC network."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/key-management"},"children":["Key management planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Blockchain nodes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provide ledger RPC access for broadcast, status checks, fee data, and indexing."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Customer-managed or third-party dependency."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Redundant node endpoints recommended."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/blockchain-nodes"},"children":["Blockchain node planning"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Compliance services and adapter"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Run transaction-screening and Travel Rule compliance workflows through configured providers."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional integration layer."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Enabled when transaction screening or Travel Rule integrations are required."]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/compliance"},"children":["Compliance"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-topics","__idx":10},"children":["Related topics"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Topic"},"children":["Topic"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security-model"},"children":["Security model"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Zero-trust model, key management, secure communication, and data integrity."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/governance-model"},"children":["Governance model"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Domains, policies, intents, approvals, and genesis design."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/data-integrity-and-audit-trail"},"children":["Data integrity and governance"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Trusted entities, Merkle tree, ARF, and signature verification."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/overview/security/secure-communication"},"children":["Secure communication"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["TLS, JWTs, mTLS, application-layer signatures, and dependency connections."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/overview"},"children":["Deployment overview"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Planning, installation, configuration, and verification sequence."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/deployment/planning/resilience"},"children":["Resilience planning"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Component ownership, state, HA, and DR model."]}]}]}]}]}]},"headings":[{"value":"System architecture","id":"system-architecture","depth":1},{"value":"Architectural principles","id":"architectural-principles","depth":2},{"value":"Logical architecture","id":"logical-architecture","depth":2},{"value":"Trust and responsibility boundaries","id":"trust-and-responsibility-boundaries","depth":2},{"value":"Deployment models: who runs what","id":"deployment-models-who-runs-what","depth":3},{"value":"Runtime flows","id":"runtime-flows","depth":2},{"value":"Governed state mutation","id":"governed-state-mutation","depth":3},{"value":"Outgoing transaction","id":"outgoing-transaction","depth":3},{"value":"Incoming and indexed activity","id":"incoming-and-indexed-activity","depth":3},{"value":"Component summary","id":"component-summary","depth":2},{"value":"Related topics","id":"related-topics","depth":2}],"frontmatter":{"seo":{"title":"System architecture"}},"lastModified":"2026-08-04T20:25:11.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/overview/architecture","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}