Band a trade. Watch the wire. Verify the answer yourself.
Everything on the left happens in this browser tab. The values you type are banded and hashed here; only commitments are sent. The right pane shows the exact bytes that will cross the wire, and then scans them for the numbers you typed — so the central claim is something you check, not something we assert.
① Local — never leaves this tab
The shared secret is the key you and your counterparty agreed for this corridor. It derives the per-shipment salt. It is never transmitted, and the operator has no way to obtain it.
In two-dimension mode the leg’s total value and
unit quantity below become the two figures the dimensions are derived from — unit
price is value / quantity. Both stay in this tab.
Or load a batch from the on-prem bander
The bander is a single binary that runs next to your trade-finance extract: raw values in, salted commitments out, no network. Its output already carries a pinned bander identity, so the operator can report whether both parties ran a binary the other recognises.
② The wire — exactly what leaves
What leaves this tab, drawn: each leg’s sealed commitments beside the figures that stayed behind. The exact bytes handed to fetch are one click away — fingerprinted and copyable, so you can hash them yourself.
Try to break it.
Every attack below sends a genuinely malformed or forbidden request to the live operator and prints its real answer — and you control the payload: type your own trade value, salt, price table or filing key, see the exact bytes that will be sent, then press Attack. These are not canned responses — you can watch them in your network tab. A product whose safety claims cannot be attacked in public is a product asking to be taken on faith.
How much of your book is defendable today?
The number that moves a compliance committee is the one they can compute about themselves, now — not "join and it gets good later". This runs entirely in this tab: your counterparties are salted into opaque pair commitments locally, and nothing is sent anywhere. The ranked list of who to onboard next falls out of the same arithmetic.
Your book — never leaves this tab
One row per counterparty and HS chapter. live is whether that counterparty is already on a ratified corridor with you. Counterparty names are hashed under your member secret before anything is computed.
Coverage
Load a book and press compute. Nothing is transmitted.
Evidence you can hand over.
Every artefact here is fetched from the live operator and then verified in this tab against its published keys. If verification needed our servers, it would be a claim rather than evidence.
Trust certificate
A reconciliation track record: counts and one proportion, always with its denominator. Never a score, a rating, or a price — your own model decides what the facts are worth.
Transparency-log head
A signed tree head over the operator's verdict ledger. Hold two of these and a consistency proof shows the ledger only ever grew — a rewritten past cannot pass.
The rail.
Who is on it and which price tables were ratified. Corridor tables are governed artefacts — the operator holds them because a quorum put them there, which is why a verdict can prove it was judged under an approved table.
Ratified corridors
Members
Billing.
Mirror is priced by the corridor, per year, split between the two members — never by the trade, the seat, or a cut of flow. What you generate here is a signed statement: a record your finance team acts on, paid by ordinary transfer against the corridor agreement.
There is no “Pay” button, on purpose
Mirror never moves, holds or settles money. It issues a signed statement and stops there; the money moves through your own bank, against the corridor agreement, exactly as any inter-institution fee is settled. Adding a charge control would make Mirror a payment processor — a different regulated business, and a boundary this product will not cross. See the pricing page.
Generate a statement
The rate card is party-supplied — Mirror invents no prices. The corridor figure is the indicative bilateral rate the pricing page publishes: €240,000 per corridor per year, all-in, which is €120,000 per member. Change it to match your ratified agreement. A card naming any of the eight refused fees — per verdict, basis points, seats, settlement, filings, conversion, scores, volume bands — is refused, not computed.
Connection.
Your pilot token is held in this tab's session storage only. It is never written to a cookie, never sent anywhere but the operator you name below, and it is gone when you close the tab.
Sign in as a member
You prove you hold your member key; the operator checks it against the public key the registry already publishes for you. The key never leaves this tab, and a session lasts one hour before you prove possession again.
No key yet? Generate one, publish the public half to your counterparties, and have the rail ratify it by quorum. Membership is never self-declared.
Operator & pilot token
The shared pilot token is the older credential. It still works so an in-flight pilot does not break — but it identifies nobody, so nothing done with it can be attributed to your institution. Prefer signing in above.