Protect your home, your harvest or your trip. If the thing you insured against happens, the money arrives on its own. There is no claim to file and nobody to convince.
if magnitude ≥ 5.5 within 50 km of 40.99, 29.03
then pay 25,000
You write the condition when you buy it: the peril, the place, and the figure that has to be reached. It goes onto the chain as written, and after that neither side can change it.
The instruments record the event whether or not anybody holds a policy on it. Nothing about this step belongs to us, which is the point of settling on a public figure rather than on our own opinion.
Independent validators report the figure from the official source and stake their own deposit on it. Disagreeing is possible; it is only expensive. What reaches the chain is the median of what they agreed.
The chain compares the attested figure with your rule. There is no assessor, no file and no queue, because nothing is left to decide: M7.2 is above M5.5, and 38 km is inside 50 km.
The transfer runs in the block that decided it, so the payment and the reason for it are one record. You filed nothing, and anybody can still read why it paid.
Most chains can only be pushed. Something outside has to notice that the world changed and send a transaction saying so, which is why ordinary automation is a tower of bots and keepers. Rialo can be pulled: a condition is written onto the chain and the network itself evaluates it. That is the whole of what a parametric policy needs, and it is why this protocol is built here rather than somewhere else.
Rialo calls it a predicate: a logical expression that lives on the chain rather than in a service somewhere. Your policy is one.
In Rialo's own words, continuously evaluated during block execution. Nothing has to remember to check; the checking is what a block is.
Chain state and block height, and also readings attested by the validators themselves: oracle data and calls out to the web. A magnitude is a thing a predicate can see.
The transaction is enqueued by the network, in that block or the next. Nobody files anything and nobody approves anything, because there is nobody in the path.
Rialo reads an ordinary web API from inside the chain, through what it calls REX. The shape of that matters more than it sounds: every validator performs the call itself and publishes its own answer, so what lands on the chain is not one agreed figure but a set of independent measurements.
Reconciling them is left to a separate aggregator, and the default one's rule is not published: no stated quorum, no median rule, no dispute path, nothing written about what happens when validators disagree or time out. That gap is ordinary for a young chain and fatal for an insurer, because disagreement is not hypothetical. Two seismic networks routinely publish magnitudes a tenth apart for the same event, and a policy attaching at 5.5 settles differently depending on whether the chain believes 5.49 or 5.51.
What lands on the chain is not one agreed figure. It is four answers, and somebody has to say which one settles.
Rialo does not say. This protocol does, in the contract.
So this protocol states its own rule, in the contract, before anything is bought. It is one of the terms you read on the confirm step.
3 of 4a reading counts only when three quarters of the validators reported. Below that the index is treated as unpublished, which returns the premium rather than paying a number nobody stood behind.medianthe agreed value is the middle report, not the average. One validator reading a corrupted feed moves an average and does not move a middle.5%if the reports disagree by more than this share of the median, the reading is refused rather than aggregated. Cover that pays on a figure the network could not agree on is a lottery on which validator was fastest.Rialo's devnet runs four validators, equally staked, all operated by Rialo itself, and their authority keys are 96 byte BLS12-381 public keys. The demonstration follows that count rather than an imagined one.
Rider is the only part of Clause that reasons rather than computes, which makes it the part most able to do damage. The obvious build is to give a language model an API key and a careful prompt. A prompt is a request, not a constraint: anything the model reads during a task, including a place name somebody typed, is a chance to persuade it. A key in that position is full authority.
Rialo publishes Latch for exactly this, and Clause uses it. The model key is stored there once and never comes back out. What this server holds is a scoped token, and every call passes a policy pipeline before the real credential is touched. The first filter to refuse stops it.
A prompt is a request, not a constraint.
which is why the key is not here
The model itself is Anthropic's Claude, reached through that latch and through nothing else. Naming it is part of the point: an assistant that will not say whose judgement it is running on is asking for more trust than it has earned.
spend_limita daily cap, metered against live spendendpointan allowlist, so the token reaches one endpoint and nothing else the key would openmethodPOST onlyrate_limitbecause a loop is how an agent failsLatch will also answer whether a call would be allowed without performing it and without touching the credential, so Rider asks before it spends and a person hears that the budget is used up rather than watching something fail. Buying is fenced separately again: it needs a permission signed on the buyer's own device naming the most one policy may cost, the most all of them may, the perils and an end date, and it goes through a second latch whose only upstream is this protocol's purchase endpoint.
Three of the methods below are taken straight from Rialo's published client SDK. They are the reactive machinery, and they are what a policy here is made of: a subscription is the standing condition, a triggered transaction is the moment it came true, and the lineage is how a payout can be walked back to the reading that caused it.
get_subscriptionthe condition, as the chain holds itget_triggered_transactionswhat it has fired, and whenget_workflow_lineagethe trail from a payout back to its readingThe chain reading methods are not pinned down by the public SDK, and Rialo's runtime carries SVM compatibility, so the client tries both spellings of each, remembers the one the node accepted, and says which it tried if none works.
These are Rialo's published figures, not this protocol's measurements of it. They are here because they are the reason a settlement can land in the block a reading does, rather than a day later.
Read from Rialo's developer page. This protocol runs against a simulation of a chain of that shape; what is written here about the chain is Rialo's claim, and what is written elsewhere on this site about the demonstration is ours.
Read from Rialo's own front page a few times a day. There is no feed to subscribe to: the documentation is behind a sign in and the blog answers a fetcher with nothing, so the front page is the source, and this says when it was last read.
Said plainly, because a page that lists only what is used reads as a brochure. Rialo publishes work on native privacy, on threshold cryptography and distributed key generation, and on consistency levels. None of it is in this protocol today. The parts used are the reactive ones above, the address shape, and the signature scheme a passkey signs with.
How a payout actually happens · The register, and every policy in it
Pick one. You can change it at any point.
The ground shakes, the season ends dry, the flight lands late.
A national network, a weather archive, the airline's own times. None of them is ours, and none of them is asked whether you hold a policy.
The chain compares the two. There is no assessor and no file, because there is nothing left to decide.
You file nothing. It can arrive before you have heard about the event.
Which also means it can read past your line and pay you nothing, on a day you were hurt. That is written on the offer before you pay, in the same words.
This is the difference between insurance and a bet. Cover is capped by what you say is at risk, and is refused if the thing you are insuring is not inside the area this index measures.
Seen only by the company that issues the policy, which checks that the home is yours or that you live in it (title deed or lease). The protocol keeps a fingerprint of it, not the address.
The company will want to see the paper that shows it is yours. You send it after buying, from the screen that follows or from My cover: nothing about the price depends on it, and the company decides afterwards either way.
Everything you chose, in one place. Anything wrong can be changed before you pay.
The English text is the binding one. It is the whole policy: what it covers, when it pays, what it costs, and how to cancel.
A standing instruction: you sign this purchase now and the protocol makes it on the day, at the price then, as long as it is at or under the cap you set. A home or a car is still applied for and the insurer still decides. You can cancel it any time from My cover.
These figures are computed here, in your browser, by the protocol's own actuarial model. They agree with the twenty thousand year simulation that prices live policies to within a fraction of a percent.
Ordinary insurance pays after a person agrees that it should. This pays when a measurement crosses a number that was written into your policy the day you bought it.
A magnitude, a rainfall total, a delay in minutes. It goes into the policy in plain sight.
As a predicate: a condition the network itself watches. No bot, no keeper, no company.
Read from the official source and attested by validators, so it is the figure the world sees.
Settlement runs in the same block the reading lands. You may not have heard about the event yet.
The hard part of using a chain is not holding a key, it is being asked to approve something over and over. This asks once, at purchase, with a key made on your own device.
This pays on a measurement, not on your actual loss. If the ground shakes hard at your house but the nearest station records less, you are not paid. That gap is real, it is called basis risk, and being onchain does not close it. What we do instead is show you the index, the source and the odds before you pay, and let you move the radius until the cover matches the risk you actually have.
If the source publishes nothing at all by the deadline, the policy is unwound and your premium is returned in full. Not a payout, not a lapse. The contract could not be judged, so it does not stand.
The calculation rules: sources, final figures, tests, objections · Questions people ask, and what the messages on the page mean
Behind every policy is a pool of capital and a rule that stops it writing more than it can stand behind. This is that side of the protocol.
Capital is held in three layers. A loss is taken from the first loss tranche until it is gone, then from the mezzanine, and only then from the senior. The part of each premium that pays for expected loss goes to the layer expected to pay it; the margin is shared by capital times a weight, so the layer hit first earns the most for standing there.
| Tranche | Capital | Takes losses from | Chance of a loss in a year | Expected loss | Margin weight | Expected return |
|---|---|---|---|---|---|---|
| Reading the pool… | ||||||
Capital standing behind live policies cannot be withdrawn, and the two lower tranches may not leave while that would put them below the book's one in ten year loss.
It settles every policy inside its radius, in the same block, from a single reading. That is the event the capital model prices. Set one off and watch.
Identical limit, identical term, quoted against a book that already holds eight Istanbul policies. The ninth Istanbul policy is not the same risk as the first, and a protocol that prices them alike is the one that runs out of money.
Eighty times the price for a risk whose expected loss differs by a factor of fourteen. The rest is concentration.
Capital is sized as the average loss across the worst 0.5% of twenty thousand simulated years.
A pool can be solvent on average and one earthquake away from nothing.
A provider may withdraw only what is not standing behind live policies.
Every movement is recorded, so the whole book can be rebuilt from entries and checked.
Your things, written down once: a home with its address and year built, a car with its model year, a field with its crop. When you ask for cover, they fill the form; with two cars, you pick which. Wallets and an X account you link are here too.
Assembled the way the chain would: what is armed, and what has settled. You can read the same thing yourself without this page, which is the point of it being here rather than in our files.
Your cover is held by your address, and only you can open it. Sign in with an email, Google, a passkey or a wallet, or with a key made on this device.
This page describes the Clause site and protocol as they run today. It is a plain account, not a contract.
A key is made in your browser and its private half never leaves it. The protocol receives the public half, which is your address. No name, email, phone number or password is asked for or kept.
If you choose email, Google, a passkey or a wallet, the sign in is run by Privy, a separate company. Privy keeps what you signed in with, such as your email address, under its own privacy policy. The protocol receives only a token naming your Privy account, checks it, and records which address that account acts as. It never receives your email.
A policy records its terms, the place or flight it covers, the value you declared as at risk and the address that holds it. Proofs of residency or ownership are checked and not stored: the protocol keeps one answer per claim, yes or no.
If you choose to be paid at a bank or on a mobile wallet, the protocol keeps the IBAN and the name on the account, or the provider and phone number, because a payment cannot be made without them. They are shown back to you masked, and in full only to whoever makes the transfer: the issuing company, a licensed payment partner or, until one is connected, the operator.
If you let Rider buy cover for you, the protocol keeps the limits you signed and a fingerprint of the permission; the permission itself stays in this browser. Your conversations with Rider are not stored.
When you are asked where the thing you insure is, the browser asks whether to share your location. If you allow it, the coordinates are sent to this protocol's server, which asks OpenStreetMap's Nominatim service what place they fall in; addresses you type are looked up the same way through Photon. Neither service is told who you are. The map tiles are loaded from OpenStreetMap, which sees your IP address as any website you visit does. Nothing about your location is kept except the point you choose to insure.
The contract you accept is kept with your application and your policy, and its hash is on the policy token. The address of a home or where a car is kept is shown to the company that issues the policy, so it can check that it is yours; the protocol keeps a fingerprint of it, not the address, on the policy record. Weather on the home page comes from Open-Meteo and is shown, not used to settle anything.
An insurer or reinsurer that registers gives its name, licence details and a contact address. These are shown to the reviewer who checks them and, once approved, the name and licence are public.
Your key, your language, your theme and the country you chose for the live bands. Nothing is used for advertising and no tracking scripts are loaded. The typefaces come from Google Fonts, so Google sees the request for them, as it would for any site that uses them.
You can remove your key from this browser at any time with "Forget this device" on the My cover page.
This is what a policy does, without the policy. Write down a question the protocol can answer, and it reads the same sources a settlement reads and hands back the figure, the record it came from and the three clocks involved. Nothing is staked on the answer and nothing is paid on it.
The useful half of one is here: the answer is settled by reading a primary source rather than by counting opinions, which is the same thing that makes a parametric policy work. The other half is not. What separates insurance from a wager is that the buyer has something actually at risk, and this protocol refuses cover to anyone who does not; a question with money on it has nothing behind it at all. So there is no stake here, no pool and no score, and there will not be.
Written down before anything happens, peril by peril: which source is read and which stands in when it is silent, what counts as the final figure and when it is frozen, the tests a reading must pass, how long you have to object, and what happens if a publisher goes away. The same text is section 10 of every contract.
The policy expires at the end of its term and the premium comes back in full. No estimate is put in the missing reading's place.
That reading is not used at all, and the next source in the peril's fallback chain is read instead, in the order written down here.
Nothing settles. Where the validators differ by more than the peril tolerates the reading is refused rather than averaged, because an average of two answers that cannot both be right is a third answer nobody measured.
Short answers, in plain words. Where a message on the page is quoted, it is quoted exactly, so you can find it here.
It pays on a measurement, not on an assessment of your damage: an earthquake's intensity at your address, the wind at your place, the rain at the station, a flight's delay. When the measurement crosses the line written in the policy, the payout is made on its own. There is no claim to file and nobody to convince.
The measurement can miss your loss both ways: a roof can go on a day short of the trigger, and a payout can arrive for a day that did no harm. That gap is basis risk. It is stated before you pay because a cover that hides it is not honest about what it is.
A licensed company, chosen on the confirm step from those licensed where the thing you insure stands; its name, its supervisor and its fee are shown. The pool stands behind that company as capital. On this demonstration the companies are stand ins, marked as such, and nothing written against them is cover.
Because that is the line between insurance and a wager. Cover is capped by what you say is at risk, and refused if the thing insured is not where the index is measured. Both are checked here and again by the protocol.
Expected loss from the model, plus a load for the capital the risk ties up or for passing it to a reinsurer, plus expenses. The confirm step's "show how this price was worked out" lists each part and the chance of a payout.
No. In Türkiye DASK is compulsory for dwellings and pays assessed damage up to its cap; this cover pays on the measurement, fast, and sits alongside it. The confirm step shows what the same home would pay DASK, for comparison.
USDC is the protocol's unit of account. On this demonstration new addresses are funded with demonstration money and there is a top up button on My cover; none of it is real. Where the law requires it, premiums and payouts settle in the local currency through the issuing company.
Where your country's rules allow it, the confirm step offers plans. The first payment is held when you apply and taken when the company approves; a payment missed for more than fifteen days ends the policy, and anything still owed is deducted from a payout.
Within an hour of buying, all of it comes back. Within the cooling off period your law gives, all of it comes back. After that, cover that cannot be foreseen (earthquake, storm) returns the unexpired part when you cancel; rain and flights run to the end of their term. Nothing can be cancelled once its trigger has been reached.
No. The price you see is the pool's price plus the issuing company's fee. The platform is paid by the company, out of that fee, and a fee that comes back to you takes the platform's share back with it.
On My cover, with its terms, its status and its token. The token is locked to your address and cannot be transferred; a cancelled policy's token is burned and leaves the wallet.
No, and that is deliberate. Cover starts after a wait: three days for earthquake, ten for storm and vehicle flood. An event inside the wait pays nothing, and it does not end the policy either, because the cover starts on the day your contract names and runs its full term from there. Drought works differently, because a dry season cannot be waited out: the season a policy measures is the next one to open at its station, and sales for a season close fifteen days before it opens. A flight has no wait, because the cover names one flight; instead it has to be bought at least 24 hours before the scheduled departure. The reason is the same in every case: the price is the chance of an event for someone who does not know one is coming, and a storm is on the news a week before it lands.
By the calculation rules, written before anything happens and printed as section 10 of your contract: which source is read and which stands in, what counts as the final figure and when it is frozen, the tests a reading must pass, the chain's attestation rule, and the objection window. The Calculation rules page shows them peril by peril.
The protocol's own chain is the record. Beside it, a public chain (Base Sepolia) is told of each token minted or burned, each settlement, and the root of the whole book on a timer. The Proof page shows what was sent and lets you check your policy's place in the book in your own browser.
Settlement happens on chain the moment the reading crosses the trigger; My cover shows the payout and the Proof page shows the reading, the block and the policy it settled. A bank payout, where you chose one, follows within the days the company states.
Yes. From My cover a policy that is ending can be renewed on the same terms, and a standing instruction can renew it on the day without you. The issuing company also sees which policies end within thirty days.
A home or a vehicle is applied for, not bought on the spot: the issuing company screens you against sanctions lists, confirms who you are above a certain size, and confirms the thing is yours. Your premium is held, not taken. Approved, the policy is written at the price you agreed; rejected or not decided within three days, all of it comes back.
For a home or a vehicle, the paper that shows it is yours: a title deed, a lease or the registration. Each file is sealed in your browser to the one party that will decide, opens nowhere else, and is deleted once the application is decided. My cover shows what you sent and who opened it.
The company that will decide has not yet opened its desk in a browser, so there is no key to seal your documents to. Nothing was sent. The company will ask for its documents another way, or you can add them from My cover once it has a key.
You do. Sign in as a company, take the issuing stand in's desk on the Company page and decide it there; or decide it as the operator, under Applications.
Register with the licence details, the LEI, the company's domain and its documents by kind. The operator then works a checklist: the legal entity, control of the domain, the licence and the classes it names, the signatory's authority, sanctions, live enforcement and, in Türkiye, membership of the insurers' association. Nothing is written until every required item is confirmed, and the checks fall due again a year on.
One per cent of each premium, out of the company's own fronting fee, the moment the fee is paid, never more than the fee itself. Every movement is on the company's monthly statement, with CSV, and a fee returned to a buyer returns the platform's share too.
Its book, worked: search by policy number, street, place or buyer; filters by status, province and peril; the policies ending within thirty days; open cover by province; CSV. And the applications waiting for its decision, with the documents sealed to it.
The page asked the protocol and got no readable answer within its patience: a dropped connection, a restart, or a slow reply. Nothing was taken. Reload the page and try again; if it persists, the protocol is down and the Live line at the top will say so.
The protocol has not answered the price request yet. It normally takes a few seconds; a minute or more means it could not be reached. Reload the page; the local figure is only an estimate until the protocol's price replaces it.
The pool's own rules refused: capital, concentration, or a place or peril it does not write. The reasons are shown in the same box, in the protocol's words.
A field the protocol refused, named in the message. Almost always an old page talking to a newer protocol: reload the page and go through the steps again.
Cover above the value at risk would be a wager rather than an indemnity, so it is refused rather than priced. Lower the cover, or raise the declared value if it was wrong.
The place you chose is not where the thing stands, or the index is measured elsewhere. Choose the place where the home, the car or the field actually is.
No licensed company writes this peril at this place, or the ones that do have no room. Try another amount or term; on the demonstration the stand ins' licences decide what can be written where.
The book moved between the price you were shown and the moment you signed, and the new price is higher than what you agreed to. Nothing was taken. Ask for a fresh price and decide again.
Your browser asked twice, because the first answer did not arrive, and the second ask found the first one still being worked on. Nothing was sent twice: the protocol recognises the same signed purchase and will not write it again. Look at My cover in a moment. If the cover is there it went through, and if it is not, nothing was taken.
Each address and each page is limited in how often it may ask for prices or sign in, to keep the protocol up for everyone. Wait a minute and try again.
The applicant sealed the documents to the reading key of the browser that first opened this desk. Open them there, or ask the applicant to send them again from this browser.
Operator sessions last forty five minutes and are not kept across a restart. Sign in again with the token.
On the policy itself, under My cover: "Raise a complaint" opens a thread with the issuing company, and its time to answer is counted from that moment (fifteen days in Türkiye). If it does not answer in time, or the answer does not settle it, one click takes it to the ombudsman (the Sigorta Tahkim Komisyonu in Türkiye) with the file its form asks for: the policy, every reading and settlement, the whole thread. The Proof page shows the same readings, so a dispute starts from the facts.
Whether an insurer is worth trusting comes down to three things: whether there is money to pay you, who decides that it pays, and whether it has paid anybody else. Each is answered below out of what the protocol stores, and where it could not be asked the page says so instead of filling the space. Any one policy's own record is an id away.
In ordinary insurance why a policy paid, or did not, sits in the insurer's own file and you are asked to accept it. Here it is assembled from what the chain stored: the subscription, every round of validator reports on the topic it listens to, what the aggregator concluded about each, and the transaction that paid.