# ๐Ÿค– Funding without control โ€” notes, the waterfall, and the public ledger > **Status: designed, not adopted.** No notes exist and no money has been > taken under this model. This document is the plan of record for how outside > investment would enter, sit, and leave โ€” it becomes live only after an Irish > solicitor and tax advisor have reviewed the instrument (ยง Regulatory > guardrails) and Series 1 is deliberately opened. Until then it is a spec, > and like every spec in this repo it is published so it can be argued with. Eleven takes no venture capital. The product is public-service *and* commercial โ€” members pay for what things cost plus resilience (`docs/tier-economics.md`), and the books are already on the public record (`docs/status.md`). This document extends the same posture to investment: money may fund the work, but **money has no control**. There are no investor shares, no board seats, no votes, no exits. What an investor buys is a position in a published algorithm; what protects them is not power but transparency with teeth. The model in one paragraph: investors buy **profit-participating notes** in named series. The money sits through a **seasoning period** and behind a **reserve floor**, then a quarterly **waterfall** streams distributable surplus out โ€” pro-rata to noteholders until each hits a fixed **cap multiple** and the note extinguishes, alongside fixed shares for the team and the commons. Every parameter, every computation input, and every payment is published in a machine-readable **ledger** on the status pages. The algorithm is versioned in this repo; each series pins the version it was sold under. An independent **verification panel** โ€” funded senior to everyone as an operating cost โ€” audits the claims: the encryption architecture, the published economics, and whether the money actually moved the way this document says it must. ## The one rule here: money has no control - Notes carry **no votes, no board seats, no vetoes, no information rights** beyond the public ledger everyone already has. - The **only enforceable investor rights are the transparency promises**: that the ledger publishes, that the verification panel stays funded, and that distributions follow the pinned algorithm. Breach of those โ€” and nothing else โ€” gives noteholders a remedy (ยง Events of default). - The company can always refuse money; money can never redirect the mission. Mission changes sit behind the guardian's golden share (ยง Entities), which no amount of investment can buy. - Symmetrically, **the company cannot change a sold note**. Algorithm changes apply to future series only (ยง Changing the algorithm). ## Entities Two entities, one of which does almost nothing: - **The operating company** โ€” an ordinary Irish private company (a DAC if we want the mission bound into a legal objects clause). It runs everything: the fleet, payroll, the raise itself. Deliberately boring to operate. - **The guardian** โ€” a small passive entity holding a single **golden share** in the operating company's constitution. Its only powers are vetoes: sale or merger, weakening the E2EE architecture, gutting the licence, or applying an algorithm change retroactively to sold notes. It never trades, never employs, never touches product decisions. (Form โ€” CLG, trust, or an existing steward foundation โ€” is an open decision; the lesson from the earlier CLG is that the mission lock must never be the *operating* entity.) ## The instrument: profit-participating notes A note is a simple contract, identical for every investor in a series: - **Principal** โ€” the amount invested. - **Cap multiple** โ€” the total the note can ever return, as a multiple of principal (default **2.0ร—**; a series fixes it anywhere in 1.5ร—โ€“3.0ร—). No interest, no compounding, no fees: the cap is the whole return. - **No maturity date** โ€” the note lives until its cap is reached through the waterfall, however long that takes. Distributions scale with revenue and nothing else. - **No security** โ€” noteholders rank as unsecured creditors behind ordinary trade creditors and payroll. This is at-risk money and the note says so plainly. - **Algorithm pin** โ€” the note names the git commit of this document it was sold under. That version governs the note forever. ## Series Raises happen in **named series** (S1, S2, โ€ฆ), the way releases are minted. A series fixes, before it opens: its size ceiling, cap multiple, seasoning period, and algorithm version. All of that is published in the ledger when the series opens โ€” terms are identical for every subscriber and there are no side letters, by rule. The company may refuse any subscription without reason (mission-alignment is allowed to be a judgment call), and every subscriber clears KYC/source-of-funds checks before funds are accepted. ## Inflows and seasoning Subscribed money lands in the treasury and **sits**: - **Seasoning**: no distributions to a series' noteholders until the later of (a) **24 months** after the series closes and (b) the reserve floor holding for **two consecutive quarters**. New money funds building first; it cannot arrive and immediately start extracting. - Seasoning gates *noteholder* payments only โ€” the verification retainer and ordinary operations are never gated. ## The reserve floor Before anything is distributable, the treasury must hold **12 months of budgeted operating costs** (the budget itself is a published ledger input). Below the floor, nothing streams and the ledger says so. The floor is recomputed each quarter from the forward budget, so growth raises it. ## The waterfall Computed once per quarter, from cash actually received and spent โ€” no accrual games. Normative pseudocode; the prose around it explains intent, but a note incorporates this computation by reference: ``` quarter(q): R = cash revenue received in q C = operating costs paid in q # includes the verification retainer F = reserve floor top-up needed # to reach 12 months forward budget D = R โˆ’ C โˆ’ F # distributable surplus if D โ‰ค 0: publish inputs; distribute nothing else: investors = 0.60 ร— D # pro-rata by remaining cap, seasoned series only team = 0.25 ร— D # the profit-share pool commons = 0.15 ร— D # price cuts, free-tier subsidy, aligned grants each note's payment = investors ร— (note remaining cap รท ฮฃ remaining caps) a payment reduces the note's remaining cap; at zero the note extinguishes rounding: the investor and team pools round down to the cent โ€” leftover cents always land with the commons, never the money if no note is seasoned: the investor pool is retained in the treasury (never redirected to the other pools; team and commons still flow) if the pool exceeds every remaining cap: notes fill and extinguish, and the excess is published as residue โ€” its destination is a decision made and published at the time, like the post-extinguishment fold below when all notes are extinguished: investors' 60% folds into commons and team (35% / 25%), or into lower prices โ€” decided and published at the time ``` Notes on intent: - **Pro-rata by remaining cap**, not by principal โ€” so early series aren't crowded out by later, larger ones, and every note converges on its cap at the same relative pace. - **The commons share is accounted publicly**: each quarter's ledger entry says where the 15% went (which prices were cut, what was granted, to whom). - The split constants (60/25/15), the cap-multiple range, seasoning, and the reserve months are **parameters of the algorithm version** โ€” changing any of them is a new version (ยง Changing the algorithm). A worked quarter, for scale honesty: Series 1 raises โ‚ฌ300k at 2.0ร— โ€” a โ‚ฌ600k lifetime obligation ceiling. A quarter brings โ‚ฌ40k revenue, โ‚ฌ28k costs, โ‚ฌ4k reserve top-up โ†’ D = โ‚ฌ8k โ†’ โ‚ฌ4,800 to noteholders, โ‚ฌ2,000 to the team pool, โ‚ฌ1,200 to the commons. Remaining caps fall to โ‚ฌ595,200. At that pace the cap is decades away โ€” the honest reading is that **noteholders are paid back at the speed the product actually earns**, and possibly never in full. This is patient, at-risk money by construction, and the offer documents say exactly that. ## Verification: the assurance panel The credibility of every public claim โ€” "the server holds only ciphertext", "the price is the cost plus resilience", "the money moved as published" โ€” rests on someone independent checking. The panel is what the raise structurally guarantees: - **Funding is senior by construction**: the retainer is an operating cost (inside `C`), never a waterfall share โ€” it cannot be starved by tuning the splits. It is prefunded **12 months ahead** in a segregated account, topped up quarterly; if the balance ever drops below 12 months, that is an **assurance lapse**, published as a flag on the status pages the day it happens. - **Independence is contractual**: at least three members; the company appoints at most a minority; members cannot be removed, and the retainer cannot be reduced, in response to findings. - **Output is public**: at least annually, unredacted after a fixed 30-day remediation window โ€” (1) an architecture audit of the E2EE claims (`docs/no-plaintext.md`, the security ledger), (2) a ledger audit (do the published numbers reconcile to bank statements), (3) an economics audit (are the published allowances the enforced ones โ€” `docs/tier-economics.md`), and (4) an **algorithm-compliance audit**: were the quarter's distributions the pinned algorithm's outputs for the published inputs. ## The ledger The money's public record, in the committed-data pattern the status pages already use (`docs/status.md` โ€” carbon, economics, contributors): - **`web/status/funding.json`** โ€” committed data, republished as-is by the box's status timer alongside `funding.html` (the **Investing** tab of the status pages, which also carries an interactive simulator that imports and runs the served algorithm module over a chosen scenario). Three arrays: - `series[]` โ€” id, opened/closed dates, size, cap multiple, seasoning, algorithm version (git commit). - `notes[]` โ€” **pseudonymous** note ids with principal, remaining cap, series. KYC identities stay private (they are personal data and buy no influence anyway); amounts and movements are public. - `quarters[]` โ€” every input (`R`, `C`, `F`, the forward budget behind the floor) and every output (per-note payments, team, commons, and where the commons went), plus reserve and retainer balances. - **All ledger amounts are integer cents** โ€” no floats near money, and every computation is deterministic to the cent (remainder cents are assigned by largest fractional remainder, ties broken by note id). - **The algorithm ships as code**: `web/status/waterfall.js`, a pure function from `funding.json` to the quarter's payments, Node-tested against pinned vectors (`test/waterfall.test.mjs` + `test/waterfall-vectors.json`) in the same style as `format.js` (`tools/waterfall.mjs` re-exports it for Node-side use). It lives in the published status directory on purpose: the Investing page serves it *and* imports it, so the public simulator runs the normative module rather than describing a copy. Anyone can re-run it: **an audit is a re-execution**. Legally the pinned prose governs; a divergence between prose and code is a defect fixed in code, in public. ## Events of default โ€” the teeth The note's only covenants are the transparency promises, so those are the only defaults. If any of these holds and is not cured within **90 days**: 1. the ledger stops publishing, or publishes figures the verification panel finds irreconcilable with bank records; 2. the assurance lapse flag stands uncured (the panel defunded); or 3. a distribution is made off-algorithm, or an algorithm change is applied retroactively to a sold note โ€” then every note's **unreturned principal becomes repayable**. That is the entire remedy: no step-in rights, no board seats, no control even in default. Investors can force the money back out; they can never take the wheel. ## Wind-down - **Solvent wind-down**: after all obligations, remaining treasury goes first to notes up to *unreturned principal* (not cap), then to the commons โ€” published, like everything else. The golden share blocks sale-for-parts as an exit. - **Insolvency**: notes rank as unsecured, behind trade creditors and payroll. The offer documents say so in plain language. ## Changing the algorithm This document is versioned in git; **a note pins the commit it was sold under and that version governs it forever**. Changing parameters or mechanics is a new version that can apply only to series opened after it โ€” enforced twice: contractually in the note, and by the guardian's golden-share veto on retroactive application. (The deploy-pinning instinct, applied to money.) ## Regulatory guardrails The structure must stay inside these lines, and adoption is gated on professional review of each: - **Prospectus rules** โ€” notes are securities; offers stay inside an EU Prospectus Regulation exemption (the Irish national threshold โ€” confirm the current figure with the solicitor โ€” and/or โ‰ค149 non-qualified persons per member state, and/or qualified investors only). Series size ceilings are set to keep each raise inside the exemption used. - **Not deposit-taking** โ€” the money is at-risk with contingent, algorithm-determined returns and is never repayable on demand (default remedies excepted). Nothing in the copy or the contract may resemble a deposit. - **Tax** โ€” profit-participating interest can be treated as a distribution (non-deductible) in Ireland, and withholding may apply to payments. The waterfall's economics are only real once the instrument's tax treatment is nailed down; this is the advisor's first question. - **Per-series sign-off** โ€” every series gets legal review before it opens, not just Series 1. ## What this is not - Not VC: no equity, no exit, capped upside, revenue-paced returns that may take decades or never complete. It selects for patient, mission-aligned money โ€” customers, peers, steward-ownership funds โ€” and that is the point. - Not a bank: money in is at risk, and "sits for a while" is seasoning, not safekeeping. - Not governance: the raise funds the work and the checking of the work. The mission is locked where money can't reach it.