Ledger model
How Sotto uses Canton
Canton supplies identity, authorization, atomic execution, and stakeholder-scoped visibility. The web session identifies the user; the corresponding Canton party owns and authorizes ledger data.
Canton identity controls access
Sotto users do not connect MetaMask, manage seed phrases, or sign browser transactions. During signup or invitation, the Sotto operator allocates a Canton party and grants the application service the rights required to act for that party. Email verification controls access to the signed Sotto session for that identity.
Package, not EVM contract
Sotto uploads a Daml package named sotto-payroll-bo to the Canton network. The app then creates and exercises contracts from that package. This is different from deploying one public EVM smart contract and sending transactions to a block explorer.
| Network | Five North Canton DevNet |
|---|---|
| Daml release | sotto-payroll-bo 0.2.2 |
| Execution API | Canton JSON Ledger API v2 from server-side Next.js code |
| User identity | Canton parties created for employer, employee, and auditor roles |
What is recorded
Ledger evidence
A successful command returns an update ID, and created contracts receive durable contract IDs. Those IDs are visible only to authorized stakeholders. Employer run detail exposes the payroll run contract reference under technical details; employee pages intentionally do not show party or contract identifiers.
There is no public explorer link for private payroll records because Canton does not expose confidential application contracts as a public transaction feed.