Tenon
Integration

Cut to fit the systems the market already runs.

The Dutch housing market already has its tools. Screening products check the file, mortgage advisers assess the buyer, CRMs run the agency, portals show the stock, notaries close the sale, and wallets are on the way. Tenon replaces none of them, for Rental or for Sale. It is the layer between them that turns verified facts into a lawful decision, proves the procedure that used it, and lets the market check what happened. The Mortise Map shows where Tenon joins each of them, and so where it would join yours.

Portals, aggregators, catalogues — read and verify, hold no key portals, listing aggregators, catalogues; the public reads them RESO Web API: the listings public register: RESO EntityEvent log, Merkle proofs, a named ranking parameter, the selection procedure, versioned RESOnance — open RESO and transparency read-only, no key Ravel-owned Rental and Sale listings; signed liveness checks yes/no answers without a key; no identifying data publishes listings and status yes/no answers and liveness, checked Ravel — compliance and lifecycle holds the attestation key the procedure runs as data: BPMN and DMN Rental: mandate → listing → applications → viewings → award Sale: offer → disclosure → bids → award → notary → transfer Wgv · BW 7:2 · the Wwft gate: each cited where it lands disclosure in steps the holder grants; a named ranking GDPR Art. 22: automation stops here the award: Rental — two people sign; Sale — the seller accepts then the tenancy terms, or the purchase agreement a hash-chained event log; an outbox CRM software through the integration points it already offers receives: the decision and its reason, the disclosures granted, the signed terms supplies: relations, listings, mandates, contacts the client file holds the outcome, not the file keeps contracts, e-signing and the AML check; Ravel gates on its status credential issued, presented, revoked Tacit — decisioning and credentials holds the signing key two governed rulebooks, Rental and Sale: a citation on every rule verified facts → a sealed verdict or position → SD-JWT VC yes/no answers: income ≥ M × rent · financing covers the bid revocation through a status list; erased when it expires no trained model; AI Act classification pending Wallets renters and buyers carry it, and reuse it across applications and agencies held by Tacit for now; a wallet later verified facts, handed over at the holder's request, with a record of who verified what Screening, data providers and attesters screening products: ID, credit bureau, payslips, a four-eyes check government data; mortgage advisers, appraisers, inspectors the tax authority's income attestation, as an EAA foreign evidence; references from previous landlords each holder verifies once, then reuses the credential across applications and agencies

Swipe sideways to see the whole map.

Green is Tenon: three parts coupled only by published contracts. White belongs to hosts; each tenon is cut to fit a mortise in one of them. The joints are designed, and none is yet fitted to a particular host. Held by fit, not glue.

The mortises, and one line that does not move.

Each mortise is a place where Tenon meets something it does not own, named by the product that holds it. If you make that product, the mortise is your way into Tenon. What your product already does stays with it. Each joint is designed against a published contract. None has yet been fitted to a particular host; that happens with the host, under NDA.

Screening and data providers

Tacit

Your product checks the file. Tacit is built to take the verified facts it produces, at the holder's request and with a record of who verified them. Today Tacit decides from what the renter declares; this is where your check would take that place. Tacit needs the facts, not the file.

Mortgage advisers and attesters

Tacit

On a sale, the buyer's financing statement is the adviser's, not ours. Your adviser enrols once, their firm checked against its register entry, and co-signs the statement by passkey; appraisals and inspections arrive as seals the same way. Tacit states only whether the declared financing covers a bid — the advice stays in your product.

Wallets

Tacit

The credential belongs with its holder — the renter, or the buyer — who reuses it across applications and agencies. It is issued on Europe's wallet standard, so your wallet can carry it once it accepts credentials from other issuers. Until a wallet has been tested against it, Tacit holds it on the renter's behalf.

CRM software

Ravel

Ravel is built to run inside your CRM, through the integration points you already offer, for rentals and sales alike. Your client file is meant to receive the outcome and the disclosures the holder grants, not the documents. Contracts, e-signing and the anti-money-laundering check stay in your product: Ravel records that the check was done and will not award a sale before it is. An award your system reports arrives in Ravel as a prompt a person confirms.

Portals, aggregators and catalogues

RESOnance, no key

Rental and Sale listings are published on the RESO standard — closed sales with their price — one open interface your portal, listing aggregator or catalogue can read without a bespoke feed, with a public register anyone can verify. RESOnance holds no key, so the market can check what happened and cannot change it.

Notaries

Ravel

The notary receives a handover link to the sale's sealed references and states: the declarations, the disclosure version, the agreement's clocks, the security and the registration — one read-only page the notary opens, not a bundle of documents. A feed into notary software is a joint still to be cut with its maker.

The line inside Ravel

Fixed

GDPR Article 22 keeps a decision with significant effect from resting on automation alone. Tenon treats every award as such a decision: on a rental a person makes it, a second person checks it, and both sign; on a sale the office proposes and the seller accepts. It is not a mortise: no host can move it.

Automated up to the line the law draws.

The rulebook decides where automation stops, and it can cite the reason on both sides of the line. Ravel runs the Rental and Sale lifecycles as data rather than as code paths, so everything the rulebook permits runs without anyone pressing a button.

  • Runs on its ownRental: the procedure the Wet goed verhuurderschap requires — published criteria applied the same way to everyone, a reason for every rejection, no fee to the tenant. Sale: the clocks the purchase agreement starts, and the revocations at the deed.
  • Runs up to the choiceEligibility and a buyer's position at a bid, ranking by a parameter that is named, disclosure in steps the holder grants, viewings, messages, revocation.
  • Left to a personEvery award. On a rental a person makes it, a second person checks it, and both sign; on a sale the seller accepts it. The client checks before a sale, and every mandate leg, are a person's act too.
  • Kept outsideCredit scoring by a trained model. Credit history is meant to arrive as a verified fact from the intake side, where the rulebook decides what it means.

Most automation in this market stops where its vendor's legal comfort runs out. Tenon stops where the rulebook does, and says why.

What the joint gives the market.

  • TrustSigned, revocable credentials and a register anyone can re-verify. Carried by Tenon.
  • ComplianceA rulebook in which every rule cites its source in law or market convention. Carried by Tenon.
  • VerificationDone by the products that already check the file, through the intake mortise. Carried by the host.
  • TransparencyA public register and a ranking parameter that is named, never a hidden score. Carried by Tenon.
  • SpeedVerified once, reused everywhere, answered with one yes or no per application. Carried by both.
  • AutomationThe lifecycle as data, all the way to the legal line. Carried by Tenon.

Every host gets its own map.

The drawing above is the pattern. For your company it is cut again: which of your products fills each mortise, and how each join is made. That version is written for you alone and shared under NDA, because a fit drawn for one party belongs to that party.

This is the first of the two ways to own Tenon, integrating it, drawn in detail. The second, taking the position, builds the frame around the same member.

Two ways to own this. The asset is the same in both.

The three parts are not sold apart. What differs is ambition, not the asset — and the first path reaches the second later without rebuilding.

Integrate it

Absorb it into what you already run. The parts share no code and couple only through published contracts; the credential rail speaks the standard the wallets speak; the catalogue is adoptable without a key changing hands; and Ravel sits on the platform you have rather than replacing it.

Lower risk — your position unchanged

Take the position

Run it as the rail the rest of the market verifies against. It already verifies credentials from an issuer other than itself, the register publishes what nobody else can, and the standards it speaks are the ones the market will have to meet.

The build is behind you — the position is still open

Integrate it: you own one of the members Tenon joins.

Take the position: you own the member everything joins.

The fit is the published contract. Nothing is glued, so nothing is trapped — and the same asset serves either path.

The rail arrives on a published schedule. The asset that rides it takes years to reproduce, and the runway is months. What is scarce here is lead time, and lead time is the one input that cannot be bought back.

Tacit holds the signing key Ravel holds the attestation key RESOnance holds no key attests publishes issues · revokes · seals every answer signs the record, which cannot be amended verifies presentations · publishes listings cannot issue a credential cannot write to Tacit and its own reads of the issuer carry no key either Tacit holds the signing key issues · revokes · seals every answer attests Ravel holds the attestation key signs the record, which cannot be amended publishes RESOnance holds no key verifies presentations · publishes listings cannot issue a credential cannot write to Tacit and its own reads of the issuer carry no key either
Tenon — French tenir, to hold. The joint holds by fit, and comes apart again.

A joint you can take apart is a stronger claim than one you cannot.

Any of the three can be replaced by another implementation cut to the same contract, and the structure still stands. If the answers are governed, the contracts are published and the catalogue holds no key, then nothing about how it behaves depends on trusting us — that part you check. What is disclosed rather than checked is how it was built and what it depends on, and those are stated plainly here rather than discovered later.

That is why it is worth more to someone who already has the market than to the person who built it.

These pages are the public description. The contracts behind each mortise, and the map drawn for a particular host, are available under NDA.

hello@tacit.software