Servicing and privacy

Proof of income

Payments are computed from evidence of income, which comes in levels. Stronger evidence means less risk of hidden income, and so a lower share.

1. Income vault. Optional, with consent: income lands in a vault the beneficiary owns, the holders' share is reserved at source, and the rest can be withdrawn at once.
2. Platform attestations. Payouts DF3F can read at the source, such as a marketplace or a payment provider.
3. Open banking. Read-only access to account data for the period.
4. Accountant attestation. A licensed accountant with professional indemnity insurance confirms the period. Assignments are random and a sample is re-checked.
5. Self-declaration. Accepted only together with other evidence, and priced for it.

A missing report counts as income at the trailing twelve-month level, recorded as arrears, not as zero.

What the chain holds

Public: the terms, positions, every payment and its batch status, the cap and what remains of it. Investor addresses carry eligibility flags: KYC expiry, professional status, country and any freeze.

Never on-chain: names, documents, statements or bank data. The beneficiary is beneficiaryId, an identifier derived with a secret key. The note documents, each income report and each hardship proof appear only as commitments, never as a plain hash.

The share and the hurdle are public, so payment sizes reveal a series' income above the hurdle, though not whose income it is.

Disputes

Every payment waits out the dispute window, 7 to 30 days, before it reaches holders. Inside the window only the trustee can reverse a batch, and the money goes back to whoever paid it; the undisputed part can then be posted again. After the window, release is permissionless: no one has to ask the operator for the money.

Off-chain, a dispute goes to automatic reconciliation first, then to a panel of accountants under a non-disclosure agreement, then to arbitration.

If the operator disappears

Every servicer action, including a settlement through the income vault, updates a heartbeat. After 60 days of silence the named backup servicer can take over on its own, without a vote or a court. The trustee can replace the servicer at any time. Claims, refunds, releases and maturity never depend on the operator being alive.

What holders see

Holders see the terms, the amount raised, the cap, what has been paid and what remains, each batch's status and their own claimable amount. They do not see who the beneficiary is, their statements or bank data; reports show income as a range.