TiedTo — Platform Spec v3.1

Two layers: the off-chain app runs business and admin operations; the chain is the source of truth for claims. The server holds no signing keys — every write is a Safe transaction signed by humans.

Platform structure

Off-chain layer

operations

onboarding gates (KYB / domain review / anchor + KYC)
domain + anchor verification · name-policy screening
payment verification (tx hash + unique amount)
admin dashboard · multisig sign-off workflow
bot binding (proof-of-control) · indexer + cache
KYC/KYB document storage — commitment hash only

On-chain layer

source of truth

PlanCatalogOwner Safe · timelockedaudience · seatLimit · platformsPerSeat · duration · kind — limits derived, never caller-supplied

RoleCatalogOwner Safe · timelockeduint8 indices, tags immutable — renames map label, records never rewritten

ClientRegistryAdmin Safe onlyregister · subscription · suspend · revoke · setClientAdmin — expiry derived on read

PersonRegistryclient admin SafesaddPerson · addBinding · revoke · releaseSeat — generic lookup per (platform, chatId)

never on-chain: legal names · KYC/KYB documents · emails · usernames · payment details · rep wallet addresses

Trust roles

Admin Safe — operational

2-of-3 TT operators

register clients, update subscriptions
suspend / revoke clients
set client admin wallets

Owner Safe — constitutional

TT owners

plan & role catalogs, parameters
add/remove Admin Safe signers

⏱ required timelock — public delay (e.g. 48h) so every change can be reviewed

Client admin wallets

per-client, scoped

add persons / bindings — own namespace only
revoke — fail-closed: turns trust off, never fabricates it
custodial plans: isolated per-client Safe, signer set separate from Admin Safe

Three client types, one path

	Company	Team	Individual
Anchor	Domain TXT + KYB	Domain TXT, no KYB	Public anchor (token post, snapshotted)
Gate	KYB off-chain	Domain + 2-of-3 review; every member private-KYC'd	Public anchor + private KYC gate (anti-sybil, never displayed)
Billing	Seats (persons)	No seats — per-member individual plans	Per-person plan
TYPE on card	COMPANY	TEAM — never readable as a KYB'd company	INDIVIDUAL
Claim	Full (wallet) / reduced (custodial)	Domain-anchored, explicitly no-KYB	Anchor-verified, alias-only — the anchor is the claim, KYC is the gate

Seat model — a seat is a person

seatsUsed is increment-only within a term. Revocation never silently frees a seat.

addPerson: seatsUsed < seatLimit (from PlanCatalog), then increments
revokePerson: status only — never decrements. Rotation through a 3-seat plan is impossible
renewal: new term resets seatsUsed = 0
releaseSeat: explicit, fee-gated — monetizes rotation instead of punishing operation
platforms per seat capped by the plan; identity is (platform, chatId) — usernames are never identity
no in-place edits: any change = revoke old + add new (new seat). History permanent

Flows

FLOW A / A2 / A3

Onboarding — one path, one flag

Gate: KYB (company) · domain TXT (team, +2-of-3) · anchor + KYC gate (individual)
Payment verified: tx hash + unique amount
Admin panel builds registerClient — 2-of-3 sign, Admin Safe executes
Real client record for all three types — no null clientId

FLOW C

Add a person

Client admin creates person: name, role from catalog
Per-platform invite links — holder starts each from their own account; stable chatId recorded
One signature activates the whole person — neither admin nor TT alone can produce an active record

FLOW D

Revoke

revokeBinding (left one platform) or revokePerson (left the org)
Seat NOT returned within the term; optional fee-gated releaseSeat
History kept forever — status visible on-chain

FLOW E

Customer check

Forward a message to the official bot — anti-phishing by design, never link-following
Card: TYPE · Namespace · frozen name + live handle (divergence flag) · User ID · Status · explorer link
Unknown account → NOT IN NETWORK — never "scammer"

Security model — what compromise means

Compromise	Attacker gets
Backend server	DoS + wrong cached data — detectable via explorer links. Cannot register, add, or revoke: no TT key exists on the server
One admin signer	Nothing — Admin Safe needs 2-of-3
Admin Safe (2-of-3)	Can onboard fake clients. Cannot fabricate persons for wallet-plan clients; custodial clients isolated behind a separate signer set
Owner Safe	Full parameter control — mitigated by timelock
Client admin wallet	Adds within remaining seats (billing-limited) + revoke. Fail-closed: turns trust off, never fabricates unlimited trust
Team domain DNS / individual anchor	Passes TXT / token post for that namespace only — mitigated by similarity screening, cross-reference review, 2-of-3, private KYC

TT never claims a representative is honest. TT proves: this communication account was authorized by this client, and that authorization is currently active.