Privacy Policy

Last updated 28 September 2026

Cessio is a confidential request-for-quote (RFQ) desk on Canton Network. This policy explains what the desk stores about you, why it stores it, who else can see it, and what you can remove. It covers the web app, the public API and the documentation site.

The short version

No passwords, no legal name — an account is a passkey, a contact email and a Canton party.
No third-party analytics or trackers, no advertising. Nothing is sold or shared for marketing.
Your trades are private by construction: on the ledger only you and your counterparty see them.
Your trading history is kept under your handle so you can read it back from any device you sign in from.
The desk keeps a record of every RFQ and quote it routes, for our own analysis of how it works — shared with no one.

What the desk stores

Your account. When you create one we store the handle you pick, your display name, your Canton party id, your passkey’s public key and credential id, an encrypted copy of your party key, and the date you registered. That copy is unlocked by a secret your passkey derives on your device — we cannot decrypt it, and it is useless without your device or your backup key.

Your email. Creating an account asks for a contact address. It is used to reach you about your account and your support requests. It is unverified, never sold and never used for marketing. You can change or clear it in Profile at any time; clearing it deletes it from our database.

Your access request. Cessio is invite-only. If you ask for access we store the address you gave us — nothing else. We use it to decide who to invite, to confirm the request once, and to send the invite itself — two messages in total, never a newsletter. The request is kept after you join, recording that the invite was used and by which account. Ask us and we delete it.

RFQs and quotes. The desk stores every RFQ and the quotes it draws — instruments, side, size, deadline, the makers invited, their prices — with the Canton party ids of the taker and the makers. It cannot run the auction otherwise, and the record stays after the RFQ closes: when each step happened (created, quoted, accepted, settled or closed), how it ended and why (filled, expired, cancelled, re-priced, withdrawn, failed), whether it came in through the web app or the API, and the market reference price at the time. Requests that never filled and Accept presses the desk refused are kept the same way.

Trade and RFQ history. Settled trades and the outcomes of your RFQs are listed under your handle, so any device you sign in from — and the API — can read them back. They stay until you ask us to remove them.

Technical data. Our servers log requests — IP address, time, endpoint, result — to keep the service running and to rate-limit registration and sign-in. Rate-limit counters are held in memory and disappear when the service restarts.

API keys are stored hashed. We cannot show you a key again after it is issued; we can only issue a new one.

Cookies and local storage

One cookie: your session token, set when you sign in. It is httpOnly, SameSite=Lax, sent only to the desk, and it expires. It exists to keep you signed in — nothing else. There are no analytics or advertising cookies on any Cessio site.

Local storage on your device holds your interface preferences.

What is on the ledger

Settlement happens on Canton Network. The contracts that move your assets are recorded on the participant node that hosts your party, and Canton shows each contract only to its parties: your counterparty sees the trade you did together, and nobody else does — not the other makers, not other users, not the wider network. As the operator of the desk, we see the trades routed through it.

Ledger records are immutable. We cannot edit or delete them, and neither can you. Your party id is a pseudonymous identifier rather than your name, but it is stable — treat it as public.

Why we process this

To run the desk (route RFQs, deliver quotes, settle trades), to keep your account secure, to prevent abuse, to answer your support requests, to understand how the desk performs — fill rates, response times, the quality of quotes — so we can improve it, and to meet legal obligations that apply to us. That analysis is ours alone: we do not share these records with third parties, build advertising or behavioural profiles, make automated decisions about you, or sell your data.

Who else sees it

Your counterparty — by design, and only for the trade you did together.
The infrastructure we run on — our hosting provider, our database and the Canton participant/validator infrastructure the desk uses. They process this data on our behalf.
Nobody else. The market-data sources we query for reference prices receive nothing about you or your trades. We would disclose data if a valid legal order compelled us to.

How long we keep it

RFQs and quotes, including those that never filled: while your account exists, then without your party id.
Trade and RFQ history: until you ask us to delete your account.
Sessions: until they expire or you sign out.
Account data: until you ask us to delete it.
Server logs: a short operational window.
On-ledger records: permanent, and outside our control.

Your choices

Add, change or clear your email in Profile.
Ask us for a copy of what we hold about your account, or ask us to delete it, at support@cessio.cc. Deleting an account removes the account record, its email, its sessions and the history listed under your handle; the desk keeps its records of the RFQs and quotes you took part in, with your party id removed. It cannot remove ledger records, and it does not touch your party key — that key is yours, not ours.
Depending on where you live you may have further rights over your data (access, correction, erasure, objection). Write to us and we will honour them as far as the ledger allows.

Security

Your party key is generated in your browser and never leaves it unencrypted; the copy we hold is sealed with a secret only your passkey can derive. API keys are hashed at rest and traffic is TLS-encrypted. Sign-in is passkey-based, so there is no password to steal or reuse. No system is perfectly secure, and Cessio is early-stage software — see the Terms of Use.

Children

Cessio is not intended for anyone under 18, and we do not knowingly hold data about children.

Changes to this policy

We update this page when the desk changes what it stores, and the date at the top changes with it. Material changes are announced on our social accounts and in the documentation.

Contact

Privacy questions and data requests: support@cessio.cc. Anything else: hello@cessio.cc.