> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inkwell.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Selective disclosure by design

> The positive privacy claim. Protected in normal operation; disclosable under compelled process. Not a mixer, not a panopticon.

> **CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved.**
>
> This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change.

<Info>
  **Pre-alpha vs production.** Pages that describe "the operator holds the session-to-ephemeral-key mapping" describe today's single-operator implementation. Production Dagon will distribute this custody across an [Ika 2PC-MPC dWallet network](https://ika.xyz) — no single "operator" entity will hold the mapping, and no unilateral disclosure (lawful or otherwise) will be possible without the network agreeing. The two-party composition described here is strengthened, not weakened, by the migration. See [Design Philosophy](/inkwell/design-philosophy) for the full decentralization roadmap.
</Info>

Selective disclosure is a **positive property**: the venue is engineered so
that, in normal operation, identity is protected from the public, the
counterparty, and the operator itself — and in the abnormal case of a
valid compelled process, identity becomes resolvable through the cooperation
of two specific parties.

The frame is ProtonMail, not Tornado. ProtonMail encrypts every mail at
rest; it cannot read its users' mail in normal operation; it complies with
valid Swiss court orders by surrendering what it has. The system is
legitimate precisely *because* encryption is default and disclosure is
scoped.

## What is protected

In normal operation, these parties cannot see these things:

| Observer                       | Cannot see                                                   |
| ------------------------------ | ------------------------------------------------------------ |
| Public (chain observer)        | Order contents, identities, fills                            |
| Counterparty in the same batch | Who the counterparty is                                      |
| Operator                       | Any individual order; any user identity beyond a session key |
| Credential issuer              | Any order activity at all                                    |

## What is disclosable

Under a valid compelled process (a court order served on both the operator
and the credential issuer):

* The operator produces the session-to-ephemeral-key mapping for a named
  time window.
* The credential issuer produces the credential-to-PII mapping for the
  named participant.
* Joined, these resolve one specific user's activity.

The process produces **one user**, not the book. The tape remains opaque
for every other participant.

## Why two parties

A single-party disclosure surface is a single point of compromise. A
rogue query, a breached DB, or an overbroad warrant against one entity
pulls out the whole tape.

Two-party composition requires that both parties be compelled
simultaneously and both comply. In practice this means:

* The warrant must name both parties.
* Both parties must be under the jurisdiction of the issuing court (or
  served through mutual legal assistance).
* Neither party alone can be coerced into unilateral disclosure — the
  information simply isn't there.

See: [Two-party composition](/dagon/concepts/two-party-composition) for the
cryptographic shape.

## Scope

The selective-disclosure claim is scoped to process that reaches both
the operator and the credential issuer through lawful channels. The
instruments in scope are:

* US federal grand jury subpoenas (Fed. R. Crim. P. 17).
* US administrative subpoenas within counsel-confirmed authority
  (OFAC, FinCEN, SEC / CFTC where applicable).
* Mutual Legal Assistance routed through DOJ OIA or direct treaty.
* EU national-authority production orders under the European
  Investigation Order (Directive 2014/41/EU) and national
  transpositions.
* Court orders in US, EU Member States, UK, Switzerland.

Out of scope: civil discovery not yet authorized by a court, and
informal law-enforcement requests without court order.

Users in jurisdictions whose courts cannot reach both parties through
MLAT should assume the disclosure path is slower, not that it is
absent. Users in jurisdictions whose own local legal process is hostile
to them should not assume Dagon shields them from that process — the
design protects against passive surveillance and single-party breach,
not against a US (or partner-jurisdiction) court honoring a foreign
MLAT request.

## Not a privacy absolute

Dagon does not promise "never by leak" or "never by breach." Those
phrasings are unfalsifiable and therefore dishonest. What is provable is
the shape of the disclosure path:

* **Normal operation:** no identity visible to any single party.
* **Compromise of one party:** no identity surfaced (the other party still
  holds its half).
* **Compelled process against both:** one named user is resolved.

That shape is stronger than the current TradFi norm (single-party
unilateral compliance) and weaker than a pure mixer (non-compliant by
design). It is the legitimate middle.