Programmable settlement · off-spec petroleum
Sentinel Escrow sits between a counterparty's promise and their payment. Funds lock in a neutral hold the moment an order is authorized, and release only when the thing you actually agreed to is verified, on time, full quantity, on spec.
Rail-agnostic · one correlation ID per load · every state transition audited
Buyer → Evergreen Refining
// lock funds at authorization const hold = await sentinel.holds.create({ load: "0x8d90", payer: buyer.id, payee: refiner.id, mode: "escrow", // per-counterparty terms: ["on_time", "full_qty", "on_spec"] }) // inspector attests → funds release await sentinel.events.claim(hold.id, { ref: "terminal-3/att-5521" }) → released · audit: 4 transitions recorded
Built for vertically integrated fuel operations
The handshake, priced
A load is assumed on spec until it isn't. A hauler is assumed compliant until something goes wrong. Sentinel attaches money and verification to those silent assumptions.
Money moves on a verbal assurance. If the load arrives late, short, or off-spec, you chase a refund, or eat the loss.
No clean record of who agreed to what. Demurrage and quality claims turn into he-said arguments across the supply chain.
A hauler's manifest is taken at face value. The downstream DOT, EPA, and OSHA liability lands on you regardless.
Funds lock at authorization and release only on confirmation: on time, full quantity, on spec at the receiving terminal.
Every load carries a correlation ID. Pickup, transit, and terminal handoff produce a clean, distinct, auditable trail.
Haulers post a bond against clean delivery. A documented violation redirects those funds toward remediation.
One settlement layer
Your operation transacts with haulers, collectors, offtakers, and terminals through a single neutral engine. Trusted long-term suppliers and unknown new haulers run on the same rails under different rules.
Counterparties & holds
Two products, one primitive
When a buyer prepays for a load of diesel, gasoline, or residual oil, the money doesn't transfer on a promise. It releases only when delivery is confirmed against the agreed terms. Late, short, or off-spec? Continuous reconciliation cancels the hold and refunds the buyer, no party forced to chase the other.
Explore delivery escrowBefore a hauler delivers material, they post a bond into a long-lived hold, collateral against the load being clean: properly manifested, correctly labeled, free of contaminants. A documented violation triggers a slash toward cleanup or penalty. Clean conduct returns the bond in full.
Explore compliance bondsThe lifecycle
Not a single irreversible transfer. Funds are locked at authorization into a neutral pending account, then released to the payee on a verified claim, or returned to the payer on a cancellation.
The moment an order is authorized, the money locks in a neutral pending account. It belongs to no one until terms are met. The behavior, immediate pay versus held-in-escrow, is selected per counterparty, not hardcoded.
See the enginePOST /v1/holds { "load": "0x8d90", "mode": "escrow", "amount": 184200, "terms": ["on_time", "full_qty", "on_spec"] } → state: pending · funds neutral
Not commands. An inspector, terminal operator, or safety officer triggers a settlement outcome within their authority, the payment layer never evaluates correctness itself. It records the delivery-confirmation reference without adjudicating it, keeping a clean trust boundary.
See delivery escrowIf a delivery arrives late, short, or off-spec, a timeout running continuous reconciliation cancels the hold and refunds the buyer. A claim and a cancellation racing toward the same load resolve safely, per-transaction row locking guarantees exactly one outcome.
Read the modelWho it's for
A vertically integrated business that processes thousands of gallons per hour and depends on correctly graded feedstock in and reliable refined product out.
Make the logistics promise financially real to nearby buyers, lower transport cost, underwritten.
Perform well, get paid faster. Bonded conduct turns reliability into a competitive edge.
Prepay without exposure. Money releases only against a delivery that actually met terms.
Documented, dollar-backed leverage over the conduct of every third party entering the site.
Architecture-first
The settlement layer enforces what was agreed and records what was attested, without ever judging correctness itself. The result is a clean trust boundary and an audit record that holds up to DOT, OSHA, Homeland Security, and EPA scrutiny.
How the engine worksFrom the operations floor
“We pitch lower transport cost to buyers within fifty miles. Sentinel is what makes that pitch underwritable, the money doesn't move until our terminal confirms the load. It turned a verbal assurance into a guarantee.”
“Our demurrage disputes used to be phone calls. Now every load has one record and the timeout settles it. No chasing.”
“The compliance bond gave me real leverage. Haulers post collateral against a clean manifest, behavior changed overnight.”
“Per-counterparty rules mean our trusted suppliers settle instantly and new haulers go through escrow. Same system.”
“Our auditors accepted the Sentinel trail with no follow-up. One record per load, every transition stamped.”
Talk to us about putting Sentinel Escrow between your promises and your payments, or start building against the API today.