Trilatic is the trade name of Ripplarity Inc, a Delaware corporation. This page states what the software does in a dispute, what it is prevented from doing, and what the record keeps so that any determination can later be reconstructed step by step. It is written so that a party, a regulator, or an auditor can check each statement against the record rather than take it on trust.
Software processes, screens, organises, and drafts. A credentialed human decides. A model never issues a determination: the signing step refuses any record that lacks a signer holding the credentials the program requires, and the reviewer may accept, edit, or override every part of the draft, in either direction. Whether the reviewer changed the draft is itself recorded.
Each determination is written to an append-only, hash-chained store and sealed. The seal is computed over the whole record, so the fields below are inside the seal and cannot be altered without breaking it.
Given the record, the evidence hash, and the instruction hash, anyone with the same inputs can confirm that the drafter saw exactly that evidence under exactly those instructions.
A seal is a set of hashes over the record, plus, where a signing key is configured, an Ed25519 signature over those hashes. The signature answers a narrower question than "is this determination correct," and it is worth stating the three levels separately rather than folding them into one claim. Integrity: the signature proves the seal's own hashes have not changed since the moment they were signed -- flip any field the seal covers and the signature no longer verifies. Provenance: the hashes inside the seal identify which inputs produced the determination (the evidence set, the system instructions, the rendered notice), so a party can confirm those specific inputs were the ones considered, without exposing the inputs themselves outside the sealed hash. What the seal does not do: the seal does not, by itself, let a third party re-run the draft and confirm the same output would result again -- that would require the original model, its exact configuration, and the original artifacts, none of which the seal publishes or guarantees remain available. Put plainly: a valid signature is a mechanism for detecting tampering and confirming what was reviewed, not a universal guarantee that the decision is reproducible or correct.
Everything a party submits is treated as data. Before any text reaches a model, two filters run over it and their findings are written to the record.
The prohibited-factor filter removes language about usual and customary charges, billed charges, and public payor rates, which 45 CFR 149.510(c)(5)(v) forbids from consideration. If such language somehow survives to the prompt, the draft is refused with an error rather than sent.
The instruction filter removes text that reads as an instruction to a model, such as a request to ignore prior rules or to select a named party's offer, and replaces it with a marker. The prompt then tells the model that everything after a fixed line is party-submitted material to be weighed, never followed. If instruction-like text somehow survives to the prompt, the draft is refused in the same way.
Neither filter changes the submission itself. The record keeps the submission as received; the evidence hash is computed over the filtered text the model saw, and every removal is listed on the record, so a reviewer can see exactly what was withheld from the model and why.
On the judgment path the model is asked, for each line item, which offer the totality of the admissible evidence supports, how much weight each permitted factor carries and in which direction, whether the evidence justifies departing from the offer closest to the qualifying payment amount, and a calibrated probability that a reviewing arbitrator would reach the same selection. It must answer in a fixed structure. An answer outside that structure, or one that names a line item the case does not contain, is discarded and the fixed rule is used instead, and the record says so.
The model is never asked whether a party is sympathetic, what a party has paid before, or anything a prohibited factor would inform. Its stated probability is published in aggregate on the resolver record as a calibration series, so that over time anyone can see whether the software's confidence means what it says.
Other certified neutrals may run their own cases on this software (the Arbitrator Workbench). They sign every award with their own credential, never one issued by this software. The certification id a neutral enters at signup is checked against a public registry snapshot where their program publishes one, and the result of that check -- matched, not found, no public registry, or unable to check -- is recorded and shown on every award they issue, so a reader never has to take an unverified credential on trust.
The methodology, the eligibility rules, the conflict screen, and the software's role are each versioned. A change to any of them is released as a new version with a dated note, and every determination records the version it was decided under. A determination is never re-decided under a later version.
No party material, submission, or determination is used to train any model. Case material is retained for the period the governing program requires and then deleted, as set out in the privacy notice.
Questions: compliance@trilatic.com, acknowledged within one business day.