Tokenwhitepaper.

00Abstract

$DEPH is the native token of the DEPH chain. Each node is a confidential virtual machine on Secret Network running a named, auditable image, and the chain checkpoints a public head to the Secret L1 the way a layer 2 checkpoints to Ethereum. Members hold encrypted vaults under a HealthID and set their own grants. Applications build on that substrate as clients: they take a grant, or they do not run. DEPH is not a general-purpose public smart-contract chain, so $DEPH meters DEPH rather than arbitrary third-party execution. The network provides laboratory testing, manufacture and fulfilment, data processing and model compute, and charges a markup on what it provides. That fee settles in $DEPH: half is destroyed at settlement and half is retained by the treasury. Separately, applications commit a share of their own revenue to a pool that pays members for the work of contributing data. A pool reward is a cash obligation settled in an application token, and that token is destroyed once it has been redeemed against goods. Supply is fixed at 369,000,000 with no mint authority and no governance path to raise the cap. Nothing in this design mints, reserves supply against a future emission, pays anyone for holding, or promises a rate.

01What it is

The DEPH chain is a confidential application with a public head. Each node is a confidential virtual machine on Secret Network running a named, auditable image. A member's records are stored encrypted, off the chain, under an access list the member controls. The chain is the control plane: it holds grants, job control and the unlock path, and it does not store a member's data. What is published to the Secret L1 is a hash of that control-plane state rather than anything about a person.

Computation runs where the data sits. A party posts a job, the measured image checks the grants, the job runs across only those records whose live grants cover its stated purpose, and a result leaves. The record does not. Applications that write into a HealthID vault are clients of this layer: they take a grant, or they do not run.

Because DEPH does not execute arbitrary third-party code, $DEPH meters DEPH. It is not a gas token for a general-purpose chain and should not be read as one. Architecture is specified in The DEPH chain, Technical Whitepaper v0.5.7, which this paper does not change.

02Why a token

Compute and models are commoditising. Consented biological data measured on the same people over time is not, because it does not exist until somebody produces it, and producing it is work: a sample, a questionnaire, a check-in, and permission at every step.

Work needs a unit of account and a means of payment that reaches the person who did it. What a contributor is owed is only known at the close of a period, is spread across everyone who contributed in that period, and is most useful to them as purchasing power inside the catalogue that produced the record. A token settles that cleanly. It divides to the level of a single check-in, it issues the moment a period closes, and it is spendable on the next test without a payment rail in between.

The second thing it settles is the boundary between an application and the network. An application sells to its own customers in its own currency. What it buys from the network is testing, manufacture, compute and access. Those settle in $DEPH, which gives the network one unit of account across every application running on it, however many there eventually are.

03Supply

The team allocation is locked. It vests over four years from 12 October 2026 with a 12-month cliff. Nothing unlocks in the first 12 months. On 12 October 2027, 25 per cent of the allocation unlocks, 9,225,000 tokens. From then on 1/48 of the allocation, 768,750 tokens, unlocks each month for 36 months, and the allocation is fully vested on 12 October 2030. Of the community half, 104,500,000 tokens are unlocked and held by holders, outside issuer control, and 80,000,000 form an optional compensation pool for migrated users, released from 12 October 2026 after a 3-month cliff in daily unlocks over 15 months. The liquidity and grant allocations carry no vesting schedule, which is not the same as circulating. They sit in treasury and enter circulation only as deployed, against liquidity, ecosystem work, marketing, and grants awarded on delivery.

The absence of a cliff on the treasury allocations is deliberate. A cliff creates a known date on which supply arrives, and a disclosed treasury that deploys against work does not. The team schedule is published here so that the first release and every monthly unlock after it are known in advance. The corollary is that treasury deployment, not a schedule, governs real float. Forty per cent of supply sits in treasury and nothing in this design restrains the pace at which it is deployed, which appears in section 15 as exposure rather than as an explanation.

There is no emission curve, no block reward paid in new supply and no reserve held against future issuance. Every token that will exist exists now. Because nothing can be minted, every payment the design makes comes from an existing allocation or from revenue already received.

04What the token does

Node admission is worth stating precisely. DEPH nodes are run by whitelisted partners, and who may run one is enforced by the protocol. A node is then admitted by attestation: it runs a named image, the measurement of that image is the identity of the program, and a node that cannot prove it is running that image on an admitted confidential virtual machine receives no key material and runs no job. There is no minimum stake to run a node and nodes are not slashed. A DEPH node is not a block producer for a public consensus set.

A member of any application can subscribe, test, contribute, earn and spend without holding $DEPH. Holding $DEPH confers no dividend, no revenue share, no distribution and no benefit with a standalone price. It is not a share, a unit in a fund, a debt instrument or a claim on the assets or revenues of any company. The network token meters the network, and it is deliberately not a toll on participation.

05What the network provides

An application on the substrate is buying things it would otherwise have to build, and it settles for them in $DEPH.

06The network fee

The network charges a markup of 20 to 30 per cent on what it provides, set per service class and published in advance. That fee is ordinary business revenue before it is anything to do with a token. It is not charged on an application's own margin, on its subscriptions, or on anything the application sources for itself. An application that brings its own laboratory and its own product pays only for compute and access.

6.1 Who buys the token

The application does. A fee obligation is denominated against the value of what the network provided and settled on chain in $DEPH, converted at market price, and the application acquires the tokens to settle it. That is the principal source of demand for $DEPH, and it recurs every period for as long as the application keeps taking services from the network.

It is procurement of a settlement asset rather than a treasury position, in the same way a company acquires foreign currency to pay an invoice denominated in it. The policy that keeps it that way is stated here rather than left to practice: an application buys at settlement, in the amount of the obligation, settles immediately, and holds no working balance. A period-end holding is nil or immaterial by design.

Two consequences follow and are stated rather than implied. Settlement is exposed to whatever liquidity exists at the moment it happens, which in a thin market is a real cost and is listed in section 15. And an application that takes nothing from the network buys nothing, so demand tracks what the network actually provides rather than anything else.

6.2 Fee handling

One rule, applied without discretion. The fee arrives in $DEPH, half is destroyed at the moment of settlement, and half is retained by the treasury to fund operations.

This is a fee burn, not a buyback. The network purchases nothing on a market and exercises no discretion about when or whether to act. It is also self-limiting: the fee is a percentage of a cost denominated in local currency, so at a low price it retires a large quantity and at a high price very little. It cannot be relied on as price support, and this paper makes no claim that it is.

Fee volume follows what the network actually provides, so it rises with the number of applications on the substrate and with what each of them sells. It does not rise with the price of anything.

07The data pool

Separately from the network fee, and transitionally, applications commit twenty per cent of net revenue to the token economy, where net revenue means revenue after commissions. Half of that, ten per cent of net revenue, pays members for the work of contributing data. The other half funds liquidity, ecosystem work and marketing. The pool also receives the network's twenty per cent share of institutional job revenue, described in section 10.

A single pool that paid contributors and also funded market operations would make what a member receives depend on how much the issuer chose to spend that quarter, and it would stop being a payment for work. Entry to the pool needs an active grant and a contribution. There is no stake and no holding requirement.

7.1 Scoring the work

Contribution is scored on volume, quality, verification and continuity, and measured in points. Points measure the work of producing a record. They do not measure what a member spent, and no multiplier anywhere in the design is attached to a token balance.

The schedule is deliberately weighted. A single test is a snapshot and is paid as one. The same person measured again, with a questionnaire and months of lifestyle data attached, is a record, and the multipliers are where that difference is paid for. A member contributing at the same depth every year earns a smaller share as the records around them deepen, which is the incentive working rather than a fault in it.

7.2 Settling a period

At the close of a period the application books the pool as an obligation to that period's contributors. A member's share is their points divided by the points of everyone who contributed in the same period. It is a share of a pool, not a rate, and the sum of every reward in a period cannot exceed the pool that funded it.

One consequence is worth stating because a reader will work it out anyway. The pool is a share of revenue, revenue is the number of members times what they spend, and the points being divided are the number of members times what they contribute. The member count appears on both sides. So the retail part of a point's value is set by revenue per member and by the depth of the average record, and not by how large the network becomes. What does scale is the institutional line in section 10, which is funded from outside the membership. Its twenty per cent share flows into the same pool, so institutional demand raises the value of every point.

7.3 Redemption

The obligation is a cash amount, converted at market price and settled in the application's token from the issuer's own allocation. The member may spend it, hold it or sell it. When it is spent in the catalogue, the application delivers goods and the tokens return to the issuer, where they are destroyed.

The reason they are destroyed is worth being exact about. The application was paid in currency when the member bought the original product. It booked an obligation of a share of that revenue. It has now discharged that obligation by delivering goods. The token was the instrument of a promise, and once the promise has been kept the instrument represents nothing. Returning it to a float and paying it out again would be reissuing a promise that has already been settled.

A member who holds rather than spends keeps the token in circulation. A member who sells passes it to somebody else, and the burn happens whenever it is eventually redeemed, by whoever redeems it. The burn is a function of redemption rather than of time, and no schedule for it exists or could be published.

The economic cost of a reward to an application is the cost of goods and the forgone margin on what it delivers, not a cash payment. The obligation is recognised when the points are earned and released when they are redeemed, which is ordinary loyalty accounting.

08What a token buys

Tests, supplements, clinical services, digital reports, lifestyle products and partner offers, at any application in the catalogue, priced in local currency. A member paying in token pays the local-currency price converted at market price, less ten per cent. A contribution tier may add a further discount to a combined cap of twenty per cent, earned by the depth of a member's record on the same tiers as Figure 6 and not by the size of any balance. Subscriptions are the exception and are always priced and paid in currency, because the subscription is the cash line that funds the pool.

09Application tokens

Each application on the network has its own token and pairs against $DEPH. A contributor is paid in the token of the application they contributed through and can spend it at any application in the catalogue rather than only at that one.

Two parameters are fixed by the network and nothing else is. Maximum supply is 800,000,000, set at genesis, and no issuer can raise it. Ten per cent is the genesis compensation pool, an obligation to the community that invested early in that application, and it is not the source of ongoing contributor rewards. It is separate from the $DEPH compensation pool for migrated users described in section 3. Everything else belongs to the issuer and is published by the issuer when its application goes live.

The structure matters more than the list. Every application token pairs against $DEPH, so a new application joining the substrate adds settlement volume and a pairing without changing the unit anybody uses and without fragmenting the network into unrelated economies. A member holding one application's token can spend it across the catalogue, so a brand does not need a closed loop of its own to make its token useful.

10Institutional access

An institution does not buy a dataset. It posts a job against a stated purpose. The measured image checks the grants, the job runs on admitted nodes across only those records whose grants cover that purpose, and the institution receives a result.

Revenue from an institutional job is split three ways. Twenty per cent goes to the DEPH network, which adds it to the shared data pool paid to all members. Forty per cent goes to DEPH Labs. Forty per cent goes to the members whose data the job actually used. Where the covering cohort spans members of several applications, that members' share is paid in those applications' tokens, converted at market price and pro-rated across the applications the cohort spans.

10.1 Licensing and research projects

A research project is a job. A licence to a body of results is a job that has already run. Neither is a transfer of records, and neither creates a copy of the underlying data outside the confidential environment.

10.2 Data for training

Training is a job like any other. A model is trained inside the confidential environment against records whose grants cover training for that stated purpose, and what leaves is the model or an attested result rather than the corpus. The contributor is paid under the same points method.

Two limits are stated rather than implied. A model that has already been trained is not reachable by a later revocation, and neither is a result that has already been published. The technical paper is explicit about both and this paper does not soften them.

11The network effect

Everything above exists to run one loop. A pool that pays properly for depth makes it worth producing a deeper record. Deeper records make sharper models and better guidance, which makes products people buy and keep buying. More revenue per member makes a larger pool, because the pool is a share of revenue. A deeper cohort is worth more to an institution, and members whose grants covered the work are paid by the same points method as any other reward. Which makes producing a record worth more again.

Three things are worth saying plainly about that loop.

It does not depend on a token price. Every link in it is denominated in revenue, records and results. The token is the rail that carries payment to the person who did the work, and the unit the applications settle in. If the token were worth a tenth of what it is worth on any given day, the loop would still turn, because the obligation is a cash amount and the reward is a share of it.

It runs inside an application and across applications at the same time. Within an application the loop is the one above. Across applications, each new one brings its own members and its own volume, settles in the same unit, pairs against the same token, and contributes to the same cohort. That is the part that scales without any single brand having to be large.

The retail half is bounded and the institutional half is not. A member's share of the retail pool is set by revenue per member and by how deep their record is relative to the average, for the reason given in section 7.2. The institutional line is funded from outside the membership and rises with cohort depth. Anyone assessing this should treat the retail pool as the floor and the institutional line as the thing that moves.

12Staking, governance and treasury

13Consent, revocation and erasure

One person, one HealthID, one encrypted vault. A grant names the party, the purpose, the data classes and the window. Nothing runs against a record without a live grant covering it.

Revocation takes effect immediately. Future unlocks fail, a job in flight is killed and its ephemeral working copy is shredded. Erasure goes further: keys are destroyed, a tombstone is written and the HealthID is retired. Neither reaches results already published, models already trained, or what a node saw while a grant was live. Erasure makes a storage host's remaining copy unreadable but cannot prove that a hostile host has deleted it. And because genetic data cannot be fully anonymised, a badly specified aggregate can still identify someone, which is why results stay aggregate unless a grant allows otherwise.

14Design excludes

15Where it is exposed

• Every quantified mechanism is driven by applications using the network, so with no applications there is no fee, no burn and no pairs.
• The markup holds only while procuring through the network beats contracting the same services directly.
• The launch pair requirement creates demand for $DEPH that is not consumption of network services. Its terms are not settled.
• Forty per cent of supply sits in treasury with no schedule restraining its deployment.
• The chain depends on Secret Network.
• Applications acquire $DEPH at settlement, so fee settlement is exposed to whatever liquidity exists at that moment. In a thin market that is a real cost borne by the application.
• Every conversion between a cash amount and a token quantity is made at market price. In a thin market that price can move sharply, so the number of tokens a member receives for the same work can vary from one period to the next.
• Staking is not part of the architecture and is not a use of the token. Node operation requires no stake and nodes are not slashed.
• There may be pressure to enable delegated staking. That is not the intended design, and if it is proposed we will seek prior approval from the regulator.
• The data pool is a share of revenue. Nothing subsidises it and there is no floor under it.

Two further exposures apply to anyone holding rather than using. There is no established market, so liquidity may be thin and a thin book moves sharply on small volume. And no audit has been commissioned as at this version, so no contract should be treated as audited until a report is published against a named commit. Cryptoassets can lose value entirely and no compensation scheme applies.

16Glossary

Not an offer to sell, a solicitation of an offer to buy, an invitation to invest, or a financial promotion, and no representation is made as to the future value of any token. Figures are illustrative inputs rather than forecasts. $DEPH is a consumptive utility token used to operate the network. Contribution rewards pay for the work of contributing data and are not a return on a holding. Cryptoassets can lose value entirely and no compensation scheme applies. Architecture per Technical Whitepaper v0.5.7, subject to independent audit and change.