> ## Documentation Index > Fetch the complete documentation index at: https://docs.tythe.finance/llms.txt > Use this file to discover all available pages before exploring further. # Trust & Transparency > How Tythe is built, what stands behind each part, and how you can verify every claim yourself. Before you put treasury on any platform, and before you let software act on it, you need to know two things: that it is safe, and that you can check what you are told. You are here to decide whether Tythe can be trusted with your capital and with your agents. Not just to hold a balance, but to enforce the limits you set on the programs that spend it, to underwrite you for credit, and to put your idle cash to work. This page answers that across the whole account: how each part is built, who carries which risk, and how you verify it. ### Noncustodial by construction Tythe never holds your money. Your Tythe Account is a smart contract on Base owned by your own key. Tythe holds no keys and no funds, and no Tythe role can move anything out of your account. The rules that govern your agents, budgets, counterparties, liens, reservations, run as code inside your account, at your address, and nowhere else. That is a structural fact, not a policy. The platforms that collapsed in recent years shared one trait: customer money pooled under the platform's control, reused, and lost before anyone could see it. Tythe is built so that cannot happen here, because there is nothing of yours for Tythe to reuse. You can always withdraw your idle balance with your own key, and no pause Tythe can invoke will ever stop that. ### Transparency and verification Everything that matters is on-chain and can be inspected at any moment. Your account, its balance, every mandate with its ceiling and effective values, every action your agents take, every Loan and lien, the credit market, and the first-loss reserve all live in the protocol's contracts on Base. What is not on-chain is your identity, which stays with the verification provider, and the underwriting models, whose outputs reach the chain only as signed, bounded attestations. The state of the protocol is not described to you on a schedule. It is visible continuously, and you are meant to check it. The first-loss reserve, the outstanding book, the coverage ratio, the credit market's buffer, venue signals, and indices, reproducible from on-chain state. ### A managed relationship Tythe does not treat a principal as an anonymous wallet that appears, transacts, and disappears. Every principal is verified, underwritten on its full financial picture, and monitored over the life of the relationship. Every agent is bound to a principal by a signed authorization, underwritten on its own conduct, and watched on every action it takes. This is how a serious financial institution works with its clients, and it is what makes delegated authority safe. Tythe assesses a principal on its on-chain history, its activity on Tythe, and any bank accounts it connects, and assesses each agent on the receipts it produces. The result is not a static permission. It is authority that is earned, sized, and adjusted from evidence. ### Account integrity Every capability of the Tythe Account is built to the same standard: enforced on-chain at your address, backed by established infrastructure where the work is not Tythe's to do, and honest about who carries which risk. Your balance sits in your own smart-contract account. Tythe does not custody it, pool it, lend it, or pay yield on it. The balance is divided into liened (pledged against open Loans), reserved (held for live mandates), and idle (yours to withdraw or invest at any time). The division is enforced by the account's hook on every movement, and the idle balance identity `idle = balance - liened - reserved` is formally verified. Tythe builds no payment rail. You pay directly by transfer to counterparties you have allowlisted. Your agents pay per call on x402, with your account as the payer: an agent opens a payment session that reserves a bounded amount and a range of one-time nonces, and the account signs only intents that fit that session. The facilitator that settles the payment cannot change the amount or the destination. Facilitator and rail costs are passed through at cost. A mandate is a bounded grant of authority stored on-chain and enforced by the mandate check inside your account. Every numeric field has a ceiling you set and an effective value the intelligence layer sets within it. Delegated agents can only receive a subset of their parent entity's scope and share its budget. Revocation is immediate and never blocked by a pause. The mandate check runs at your address: no validators, no operators, no third party, and no Tythe key in the loop. Be clear on the limit of this. A mandate is only as safe as its ceiling. An agent can spend its whole budget on permitted counterparties. Tythe narrows authority on anomalies; it cannot prevent every poor decision inside scope. Under the Agent Authorization you sign, you are responsible for what your agents do within the mandates you give them. Credit is the one financial product Tythe builds itself. Five controls define it. 1. **Verified borrowers.** Every borrower is a verified principal bound to a legal identity. 2. **Underwriting on real activity.** Borrowers are rated on on-chain history, activity on Tythe, and connected bank data, by a model whose structure cannot contradict established credit science. 3. **Capture at the source.** Repayment is pulled from revenue-tagged inflows as they arrive, so a borrower cannot quietly stop paying while operating. 4. **Coverage as a lien.** At origination the borrower pledges a fraction of its own balance. The rest stays free. Only the loss waterfall can consume the pledge. 5. **Bounded agent draws.** An agent draws only within its effective credit share, against its principal's Credit Limit, at terms fixed from the Rating band. The borrower of record is always the principal. Lend supplies Tythe's on-chain credit market and holds shares; the first-loss reserve stands ahead of every lender. Save deposits into curated venues on Base (and later Etheruem). Tythe curates the venues and publishes signals, indices, and reference weights, and you or your agent decide. Tythe never allocates on its own initiative and takes nothing on venue yield. Be clear on who carries which risk. A venue that loses money to market conditions is risk you chose, not an operational failure. Tythe stands behind its own underwriting with its own capital, and states plainly the risk you take. ### Default handling Loans default. A lender that pretends otherwise is not one worth trusting. What matters is the order in which a loss is absorbed, and who absorbs it first. On Tythe that order is enforced in a single transaction and formally verified. Capture continues to pull repayment from revenue-tagged inflows. The fraction of its own balance the borrower pledged at origination is consumed, up to the shortfall. Recovery is pursued against the borrower's verified legal identity under the Master Credit Agreement it signed. The first-loss reserve absorbs the loss before any lender is touched. A loss reaches lenders only after all of the above is exhausted, pro-rata across market shares. The fourth step is the one that matters. **Tythe loses its own money before any lender loses theirs.** The first-loss reserve, funded from Tythe's revenue and capital, stands ahead of every lender and scales with the book. If Tythe underwrites badly, Tythe pays for it first. ### Accountability and legal standing Tythe is operated by a registered Delaware C-corporation. It is a real company with real accountability, not an anonymous team behind a contract. Its legal posture follows from its architecture: a noncustodial protocol operator that underwrites and arranges credit, provides the mandate layer as software, and publishes intelligence as information. It never holds client funds and is not a bank. That footing is also what makes the lending enforceable and the delegation accountable. Every borrower is bound to a legal identity, so a default is recoverable in the real world, not only on-chain. Every agent is bound to its principal by a signed Agent Authorization, so there is always a party responsible for what an agent does. This is the difference between delegated authority and a key in the wild: there is a counterparty, and that counterparty is accountable. ### Risk disclaimer Tythe's controls contain risk. They do not remove it, and no honest platform claims otherwise. Loans can default beyond the first-loss reserve. Smart contracts, however carefully verified and audited, carry residual risk. The venues, facilitators, and stablecoins Tythe relies on carry their own. An agent can act badly inside its scope. And in a broad downturn, many borrowers can weaken at once, exactly when diversification helps least. None of this is hidden, because a principal deciding where to place its capital deserves the whole picture. Read the full [Risk disclosure](/get-started/resources/risk-disclosure) before committing capital or delegating authority. ### Verify further Every claim on this page is backed by a page of evidence. How the contracts are verified before real funds, the formal-verification record, and the audit reports, published in full. The reserve, the lien, and the waterfall, explained end to end. Every rail, venue, registry, and provider Tythe routes to, named, so you can verify each counterparty yourself. How principals and agents are underwritten, what the engines can set, and what the chain enforces regardless. What Tythe charges and what it does not. Tythe charges for what it builds and takes nothing on what it routes. Regulatory posture, launch markets by phase, and what is pending counsel.