Security and trust
We recomputed every entry from scratch. It reconciled to zero.
Trust in money infrastructure has to be earned with evidence. Here is ours: an independent audit of the raw ledger, the invariants we hold, our security posture, and a plain account of what is not yet production-ready.
The independent audit
Not the software's own checker, the raw tables.
On 2026-08-18 the books were recomputed directly from raw database records, deliberately bypassing the system's built-in verifier (a checker and the code it checks can share the same blind spot). Every conservation, reconciliation, authorisation, and lifecycle check returned zero exceptions.
Independent SQL audit, 2026-08-18. Conservation, reconciliation, authorisation and lifecycle checks all returned zero over 5 ledgers.
Cached balances vs. balances recomputed from full history. Total absolute drift: 0.
Domain records reconciled against ledger postings on both count and amount. Zero missing, duplicate, or non-positive grants.
Synthetic benchmark, single host, split-ledger architecture (2026-08-14). A payment is authorize plus capture. Correctness invariants held throughout.
What was checked, over 5 ledgers
- 2,284,416 transactions, zero unbalanced, zero single-leg postings.
- Trial balance exactly zero in both currencies, across all ledgers.
- 7,463 accounts, cached balances matched full-history recomputation with zero drift.
- The reporting projection reconciled entry-for-entry across two databases (5,454,688 = 5,454,688).
- 1,394,739 reward grants tied out to the ledger on count and amount, zero missing, duplicate, or non-positive.
- 22,028 limit claims, zero caps exceeded; zero accounts past their floor.
One finding, disclosed: refunds are recorded as contra postings with a reference rather than through reversal linkage, so the reversal machinery is unexercised. A documentation gap, not a defect, and now documented.
Guarantees
Properties the system holds by design.
Balanced by construction
Every transaction writes legs that sum to zero per currency. The trial balance across all ledgers is exactly zero, in every currency.
Idempotent replay
Every money-moving call carries an idempotency key and replays byte-for-byte. N concurrent duplicates move money exactly once.
Caps hold under load
Refund totals, send velocity, and reward caps are claimed inside the posting transaction. Eight sends against a limit of five land exactly five.
At-most-once billing
Subscription charges derive their idempotency key from the period, so a retry storm cannot double-bill.
Security posture
Hardened where it counts.
Credentials, containers, and payment surfaces are built to reduce blast radius, and each fix from our adversarial reviews carries a regression test.
- Card data never touches the platform, PCI scope kept at SAQ-A, top-ups run through the processor's own fields.
- API keys hashed with Argon2id and shown exactly once; short-lived RS256 user tokens with live JWKS rotation, no restart.
- Constant-time credential comparisons, 1 MiB request body caps, parameterized SQL throughout.
- Webhook targets are SSRF-checked: public hosts only, no redirects followed.
- Containers are distroless, non-root, read-only root filesystem, all Linux capabilities dropped.
- Two documented adversarial security reviews, each fix carrying a regression test.
The honest part
What is not production-ready yet.
We are pre-production, and we say so on the record. If a vendor will not tell you their gaps, they either do not know them or will not share them. Here are ours.
- This is an early-access release. The platform has not yet carried real customer money.
- All performance and reconciliation figures are from synthetic load on a single host, not production traffic.
- Live money-in runs through Stripe today; merchant payouts are executed on a manual rail with recorded references.
- Rate limiting is currently per-IP; per-tenant identity propagation is in progress.
- Hardening in flight before general availability: managed key storage (KMS), production identity deployment, database row-level security, and drilled backup and point-in-time recovery.
We share the detailed hardening backlog and audit report with design partners under NDA.
Early access
Put the books to the test.
Bring your hardest reconciliation question. We would rather earn your trust against evidence than a pitch deck.