Each lead sold once, to one accountable buyer — carrying cryptographic proof it was consented and is in-licence.
The same prospect is resold across brokers and gets hammered. "Consent" is a fiction the moment a record changes hands.
Buyers can't verify a lead, so they discount everything. The good leads quietly subsidise the bad — a market for lemons.
No recourse for the regulator, no licence the upstream data owner can trust. Everyone is exposed; no one is answerable.
The value leaks at every hop.
You architect an exchange differently. The atoms must be right on day one — retrofitting them is brutal.
The data never moves until the moment of clearing — to exactly one buyer, under live consent.
The lawful-basis spine. Versioned, withdrawable, channel-scoped — separating what we collect from what we may disclose.
The tradeable unit. Proof and claims, never raw PII — a handle to a sealed record that releases only at clearing.
The right to transact — and the compliance perimeter. A KYC'd, contracted, audited buyer; the bond against leakage.
The keystone. Settle, disclose, and prove in one indivisible act. One discloser, one recipient, one proven moment.
Settlement, disclosure, and proof — all-or-nothing. One discloser. One recipient. One live-checked consent. One proven moment.
Atomic core: a live consent & lane check, exactly-one-winner enforced by optimistic concurrency, the seat debited.
Idempotent, post-commit: the proof bundle minted, payment captured, the audit log appended.
Reconcile to settled, or compensate. Post-disclosure failure taints the lead so it can never re-clear as fresh.
Technically a saga — because proof and payment can't live inside one transaction. Exactly-one-winner is enforced, not asserted.
Their data is static.
Our conviction-truth compounds.
Every clearing returns a private, bonded conversion outcome. It sharpens the rating in a way static upstream data never can — and it's fenced to an accountable seat network with real switching costs. A competitor sitting on the same raw data has no way to rebuild it.
Anchored to real comparables, every figure assumption-flagged. Oracle-verified for arithmetic and anti-fabrication.
Annual revenue across the seven layers. The one number to verify: the take-rate floor holds iff a seat's self-source cost for an equivalent lead exceeds ~A$216.
Pay-on-outcome, exclusive, single-recipient, standing-gated allocation — a proven, profitable model. Our closest commercial template. The whitespace no comp has: the consent/lane proof spine and the bonded outcome flywheel.
The world's first lead exchange — died in 2026 on unlicensed lead-gen, not on the mechanism. External proof that lane-at-ingest and KYC'd seats are existential, not gold-plating. Our instinct was right.
Owner-marketing data has no path to the minter — the prohibited use is unrepresentable, not merely forbidden.
Disclosure rests on APP 6.1(a) consent directly, channel-scoped, with the platform sending the warm first contact.
Every lead ships with evidence it was consented and within scope — quality and compliance in one artifact.
The only exchange a regulator would point to as the model.
The moat is the murder weapon.
An unsupervised outcome flywheel is demographically entangled — without a fairness term it drifts into provable redlining, and our own audit log becomes the regulator's evidence binder. Two more: the single-discloser vault is a honeypot; the market-data feed could enable predatory targeting while staying technically k-anonymous.
Already bound as anti-goals: a fairness audit before any cell opens · a prospect-welfare term in the objective · no bulk reads, ever.
A verifiable downstream-control guarantee de-risks them — the lever to move the redistribution licence from red to amber.
Owner-data-for-marketing is un-buyable in every state, regardless of contract or proof. We concede it openly — and prove we never touch it.
And none of it gates Phase 0. The licence is an inventory expansion, not a prerequisite. The business proves itself first.
First-party data, signed proofs, routed allocation. The real gate is a consent sign-off — ours to get.
Auction, secondary re-allocation, reputation, range-proofs on conviction.
The Cotality lane opens; clean-room / TEE proof stream; market-data productised.
Rating-as-a-service, seat transfers, the forward market.
The gate that opens the business is a consent letter — not the upstream deal.
~50–60% there. The missing pieces are the market and the proof — not the data engine.
DECISIONS ON THE TABLE · take-rate band · franchise vs licensed-panel · auction design
From an exciting idea on Monday to a build-ready thesis — priced, proven, cleared.