The road to real money

• Network-fee key in a managed key service

  In use on staging and live

  Held in AWS KMS on private staging and on the live account.

  The detail

  The key that pays network fees is held in AWS KMS on private staging and on the live account. On the live account a separate signing service holds the permission to sign; on private staging and in the preview the main service still signs. A final review of the signing setup has not been done yet.

• Reconciliation with the network

  In progress

  Most checks run on private staging. A few are still to finish.

  The detail

  Most checks run on private staging: captured payments are confirmed to still exist on the network, stuck payments are flagged, the use of the network-fee key is compared with our records, and the ledger’s balance rules are re-checked on a schedule. A few checks are still to finish.

• Scheduled testing on a test network

  In progress

  A scripted test payment runs on devnet on a schedule.

  The detail

  A scripted payment runs on devnet on a schedule, and reconciliation checks run alongside it. They have to stay clean.

• Real-network behaviour measured

  Measured, read-only

  Before the first own-funds payment: 24 hours of finality timing, read-only. No funds, no payments.

  The detail

  We watched how quickly payments become final on the real network for 24 hours, using read-only calls. This was a read-only measurement; later own-funds testing is in the entry above. The measurements inform the waiting and expiry settings we plan to propose. A real-network launch is still a roadmap item, with no date.

• Test and live kept apart

  Built

  A separate account exists and runs our own-funds payments.

  The detail

  A separate account for real money exists and runs our own-funds payments, with its own network, database, key service and image build, plus activity logging and threat detection. The public entry point has request limits and an allow-list of paths. The test and devnet preview environments stay separate from it.

• Per-seller limits and caps

  Built and tested

  Run on staging with test values and on the live account. No outside seller is on them yet.

  The detail

  Limits for each seller on payment size, daily volume, unfinalized exposure, daily network fees and a monthly network-fee cap run on private staging with test values and on the live account. No values are published, and no outside seller is on them yet. Who pays the network fee is still one shared account.

• Screening of addresses

  In progress

  A daily list sync runs on staging. No provider chosen.

  The detail

  A daily sync of a public sanctions list runs on staging. The list holds very few Solana addresses, so it is a baseline, not coverage. On staging a new payment is also refused unless its source token account belongs to the payer who signs. A commercial screening provider has not been chosen.

• Internal reviews

  Done

  With fixes and tests, including a pre-launch round on the newest code whose findings are fixed or tracked.

• Running it day to day

  Partly

  Alarms, runbook and freeze switch are built and drilled in our own testing. On-call and a regular restore schedule are still to do.

  The detail

  Alarms, a runbook for reconciliation breaks and a freeze switch for the signer are built and were drilled in our own testing. A restore test has passed once. On-call and a regular restore schedule are still to do.

• Billing for the pilot

  Manual path

  Pilot invoices would be prepared by hand.

  The detail

  Pilot invoices would be prepared by hand from payment records. There is no automated metering or billing portal yet.

See the roadmap, the security page and how a payment works.