The regulated hard part, built in.
We handle other people's money. Security and compliance are the foundation of the platform, not a feature bolted on — and where something is not yet live, this page says so.
Tenant isolation by construction
Every tenant-scoped row carries its tenant, and every query is filtered at the data layer — not in application code that can forget. Cross-tenant reads are an explicit, logged, admin-only act.
Approvals that mean something
Dual approval above per-tenant thresholds, require-approval-for-all where trust money demands it, and impersonation that is always written to an audit log.
Signed webhooks, durable delivery
Every event writes to an outbox in the same transaction as the change it describes, then delivers with an HMAC signature and retries. Verify the signature; trust the payload.
Idempotent by default
Every write accepts an idempotency key. A retried request is the same request — a network timeout can never become a duplicate payment.
Money is integer cents
No floats, anywhere. Every balance is double-entry and append-only, so the books can always answer how a number came to be.
Demo data cannot pay anyone
Every figure the platform computes carries its origin. The irreversible acts — remitting tax, settling an operator, collecting an invoice — refuse any figure whose basis is not a source of record.
AI that reads everything and touches nothing.
🔒 Read-only by principle
The assistant layer answers questions across the platform. It never initiates, approves or modifies a payment — by architecture, not by prompt.
📎 Always cited
Every claim links to the dataset and screen it came from. An answer that cannot cite its source is not given.
👤 Role-scoped
Answers respect the asking user's permissions. The assistant never becomes a side door around access control.
🗂 Fully logged
Every question and answer is auditable, the same as any admin action on the platform.