Skip to main content

Data Exchange

The Data Exchange is a marketplace where organizations that do not share a secret can list, discover, and consume each other's data products, and where the trust that crosses that boundary is cryptographic and checkable without a network.

The mechanism, in four ideas​

  • A listing is a signed attestation, not a database row. Publishing an offer mints a cross-org listing that binds the offer's identity, a content fingerprint, its reach, an attenuating scope cap, and a validity window, signed with the publishing org's private key and verifiable offline by anyone holding only that org's public key. The data never crosses; only the signed listing does.
  • The signature is post-quantum hybrid, and it fails closed. A classical and a post-quantum half (Ed25519 + ML-DSA-65) are carried together, the post-quantum half independently pinned. A verifier pinned to hybrid refuses a downgrade. Signing input is domain-separated, so a listing signature can never be replayed as a receipt or a grant.
  • Provenance is checked twice: when a listing is rendered for a visitor and again when it is ingested, and a foreign, tampered, wrong-key, or forged listing is rejected against real cryptography, deny-closed.
  • One revoke, and serving stops everywhere. The exchange's grant edge is the same canonical governance edge the platform serves from, so a revoke is the authoritative deny at all three serving faces.

In this area​

PageWhat it covers
Signed cross-org listingsThe signed-attestation model: post-quantum hybrid, domain separation, and the attenuating scope cap
Offline verificationThe deny-closed gate cascade, pinned peer-org keys, a caller-supplied clock, and the Edge Agent's verify-only role
The marketplace journeyDiscover · Offer · Manage · Earnings · Spend, and the buyer request-to-grant handshake
Settlement and accrualThe signed, hash-chained, double-entry ledger in Compute Units, and what it does not do

Where the edge fits​

The Edge Agent is a consumer and verifier: it verifies cross-org listings offline and pins peer-org keys with validity windows, reading from a cell rather than serving data itself. And because an edge deployment can run a cell at the site, so the complete data platform and the exchange can run locally, sovereign and air-gapped, with no cloud in the loop. The edge device itself does not serve data on its own.

Where this is early​

The strongest part of the Data Exchange today is its cryptographic axis: org-boundary post-quantum hybrid trust, verifiable offline. What is early is the marketplace around it, meaning catalog scale, network effects, and payments. The settlement ledger accrues in Compute Units, but there is no payout leg: no money moves through it. See settlement and accrual for exactly where that line sits.