> For the complete documentation index, see [llms.txt](https://docs.bitsafe.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitsafe.finance/cbtc-1/concepts-and-reference/architecture-and-trust-boundaries.md).

# Architecture and trust boundaries

[How CBTC works](/cbtc-1/how-cbtc-works.md)

### Architecture at a glance

CBTC connects Bitcoin custody and event verification with private Canton contract workflows. This page owns the component map and trust boundaries. Lifecycle steps belong in [How CBTC works](/cbtc-1/how-cbtc-works.md); control requirements belong in [CBTC security](/cbtc-1/concepts-and-reference/security.md).

### Component map

<table data-search="false"><thead><tr><th>Component</th><th>Responsibility</th><th>Primary boundary</th></tr></thead><tbody><tr><td>Bitcoin addresses and transactions</td><td>Receive eligible deposits and deliver approved redemptions</td><td>Bitcoin transaction, fee, and confirmation behavior</td></tr><tr><td>Attestor Network</td><td>Verify eligible events and participate in threshold authorization</td><td>Independent operation, policy, and signing shares</td></tr><tr><td>CBTC workflow services</td><td>Associate accounts and events, coordinate workflows, and reconcile state</td><td>Authentication, availability, and correct state handling</td></tr><tr><td>Canton participants and parties</td><td>Host parties, contracts, and authorized commands</td><td>Canton identity, rights, topology, and privacy</td></tr><tr><td>CBTC Daml packages</td><td>Define holdings, transfers, accounts, credentials, and administrative behavior</td><td>Approved package versions and contract authorization</td></tr><tr><td>Client libraries and applications</td><td>Expose supported workflows and submit authorized requests</td><td>Pinned releases, credentials, validation, and retries</td></tr><tr><td>Proof of Reserve and reconciliation</td><td>Provide scoped evidence about reserves and system state</td><td>Completeness, freshness, source integrity, and stated limitations</td></tr></tbody></table>

### Trust boundaries

#### Bitcoin custody

Underlying Bitcoin uses FROST threshold signing across independent Attestor Network operators. The threshold is configurable, and the operator set can change. Verify current operating details through the maintained security reference.

#### Attestor Network

Event verification and signing authorization are separate responsibilities. No single operator should be presented as sufficient to authorize a custody action. The detailed signing model belongs in [CBTC Attestor Network and FROST](/cbtc-1/concepts-and-reference/attestor-network-and-frost.md).

#### Canton

Canton records CBTC contract state and applies authorization through parties, participant rights, package logic, and topology. Configurable sub-transaction privacy limits contract visibility to entitled parties; it does not hide Bitcoin transactions.

#### Integration services

Clients authenticate separately to Canton and approved CBTC services. They must validate networks, parties, addresses, package compatibility, and authoritative state before retrying an ambiguous request.

#### Evidence

Proof of Reserve demonstrates only the evidence and observation scope documented on [CBTC Proof of Reserve](/cbtc-1/concepts-and-reference/proof-of-reserve.md). It does not prove every application, custody, operational, or redemption property.

### Architecture limits

This architecture does not by itself guarantee instant Bitcoin confirmation, every external service’s availability, correct integrator configuration, protection from an authorized request containing the wrong destination, or complete coverage by one evidence source.

### Technical sources

* [CBTC library](https://github.com/DLC-link/cbtc-lib)
* [Shared Canton library](https://github.com/DLC-link/canton-lib)

### Related pages

* [CBTC token standard and contract model ](/cbtc-1/concepts-and-reference/token-standard-and-contract-model.md)
* [CBTC Attestor Network and FROST](/cbtc-1/concepts-and-reference/attestor-network-and-frost.md)
* [CBTC Proof of Reserve](/cbtc-1/concepts-and-reference/proof-of-reserve.md)
* [CBTC security](/cbtc-1/concepts-and-reference/security.md)

### Next step

👉 **Review the control model:** [CBTC security](/cbtc-1/concepts-and-reference/security.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bitsafe.finance/cbtc-1/concepts-and-reference/architecture-and-trust-boundaries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.