How it works
One payment, start to finish.
Four beats. Canton settles the money. Payvol carries the payment around it.
Each beat below says what Payvol does and what the network was already doing, so you can tell which half is ours. What has been measured, and under what conditions, is written down separately.
-
A request names who is being paid, in what, how much, and by when. It encodes to a link, a QR and an NFC tap from the same bytes, and it carries everything a wallet needs to act on it without fetching anything.
On Canton Canton provides the parties and the instrument. The request references them; it does not invent an identity system.
-
The payer opens it in their own wallet. The wallet reads the request against the profile and renders what will move before it asks for a signature. A request it cannot read is refused with a named reason rather than half understood.
On Canton Canton settles it through the Token Standard registry for that instrument. The transaction is built as a prepared transaction and signed by an external party key that never leaves the payer.
-
The settlement lands on the payee own participant. A digest of the request travels with it in the metadata, along with a profile identifier, and nothing business meaningful goes on ledger at all.
On Canton Canton decides who sees it, and the answer is not us. The payer, the payee and the instrument registry can read the identifier. A party that took no part reads nothing. The registry is a signatory of the template, so this is structural rather than a choice of ours.
-
The digest is what connects the payment to the request that asked for it. Matching becomes classification: amount, timing, instrument, receiver and policy answered separately, so a payment that is the right amount to the wrong account does not read like one that is late.
On Canton Payvol classifies and hands over. The ERP closes.
What is not in this picture
Two of the six modules are planned rather than built. Route, which would let one request offer several ways to settle, and Connect, which would carry a classification into the system that posts it. Neither appears in the four beats above, because neither runs.
No implementation can verify a Payvol signature yet, because the Canton external party key and signature scheme is an open question. The bytes a signature must cover are pinned by conformance vector, so two implementations cannot diverge on them.
Six situations this happens in What has been measured Try it in the app