Checkable, not just credible.

A reviewer should know in advance what can be examined, what remains outside the review boundary, who holds each decision, and how the supporting evidence can be requested. The objective is simple: make the important controls observable without exposing the systems and information those controls are designed to protect.

Control domainsFour separate layers

Environmental verificationHeld byregistries and verifiers (methodology, MRV, issuance)

Program governanceHeld bythe program manager and the governance and authorization layer

Technical validation and reconciliationHeld byPVN

Register and key controlHeld byOrigin Ledgers, which operates the register and signs register operations with registrar keys. It holds no assets on behalf of participants.

No layer performs another layer's role.

Four claims we can be held to

Four claims we can be held to.

No keys in the validation layerPVN holds no participant private keys, signing secrets, custody credentials or registrar keys, and has no authority to move assets. The boundary is defined by capabilities the validation layer does not have, not by a promise that they will go unused.

Independent per-event validationA successful event does not validate the next one. Each lifecycle event is evaluated against its own inputs, references, rules, and current state.

A failure is never silently reclassifiedRetry is a legitimate route to success: an execution that fails can be retried and can complete. What cannot happen is a state changing without the record changing with it. Validation rejection, execution failure, retry, successful execution, pending reconciliation, reconciliation exception, and terminal failure are distinct recorded states. An event reaches completion only by passing the required revalidation or retry path — never through elapsed time or a partial confirmation.

Example: a registry that cannot retireCredits stay held until the registry confirms retirement. If it never can, a recorded decision releases them. They are shown as Released, not retired, so the failure stays visible.

What Origin Ledgers warrants when it sells a creditThat it holds title, that the credit exists in the originating registry, and that it has not been sold or retired elsewhere. It does not certify the project’s environmental outcome.

Roles and controls

Who can do what.

RoleDeterminesAuthorizesValidatesExecutesRecords

Program managerProgram rules, boundary, limits, allocation, enforcementProgram-level actions under its governance; participant actions only under an explicit, revocable mandate——Program terms and framework selection

Participant—Its own lifecycle actions through its Origin Ledgers account———

Project developerWhich of its credits to list——Listing credits held in its own account at an approved registry—

RegistryUnderlying credit issuance and status——Recording the retirement in the registry of recordThe underlying credit and its retirement

Origin LedgersPolicy and compliance checks; the sale price of carbon credits——Sale of carbon credits; retirement in the originating registry; registrar signing after authorization and validationThe program-specific lifecycle and positions

PVN——Lifecycle events against defined rules; reconciliation—Validation and reconciliation evidence

Infrastructure

Providers.

13 providers

Origin Ledgers uses Fireblocks as key-management infrastructure for its registrar keys, used to sign register operations. Participants hold no keys; PVN has no access to the registrar keys.

Participants' designated virtual accounts are provided through Banking Circle. A designated virtual account is not a bank account in your name. Origin Ledgers orchestrates this infrastructure; it is not itself a bank or payment institution.

Cloud provider03

Amazon Web Services (AWS)

Hetzner

Siteground

Security03

FireblocksKey-management infrastructure for Origin Ledgers’ registrar keys, used to sign register operations.

Station70

Vanta

Finance and payments01

Banking CircleDesignated virtual accounts

Identity provider02

Microsoft 365

Persona

Version control01

GitHub

Collaboration02

Slack

Zoom

Product and design01

Anthropic (Claude)

Naming a provider describes the infrastructure used. It is not a partnership, endorsement or certification claim.

The uncomfortable half

What we don't show you is also part of the design.

A review that required private keys, production credentials, sensitive infrastructure details, or customer data would introduce risk without necessarily producing better evidence. The standard exclusion boundary is therefore defined in advance and applied consistently. When requested material falls outside it, we explain the boundary and the reason for it rather than changing the rules during the review.