How we operate

Financial software earns trust by being provable, not persuasive. Each of the four commitments below maps to a concrete guarantee in the platform — an auditable log, reviewed payouts, encryption by default, and a hardened surface from end to end.

1. 01

   The ledger is the source of truth

   Every balance is derived from an immutable, double-entry transaction log. Nothing is edited in place — corrections are new entries, so the history is always provable.

   Balances are derived from an immutable, double-entry transaction log rather than stored as an editable number. That means any balance can be re-derived from first principles and proven at any time.

   Nothing is ever changed in place. A correction is a new, offsetting entry — so the full history stays intact and every state the account has ever been in remains reconstructable.

2. 02

   Every payout is reviewed

   Returns and commissions are drafted, reviewed, then published. Large withdrawals require two distinct approvers before a single cent moves.

   Returns and commissions follow a draft → review → publish loop. Amounts are staged, checked, and only credited on publish — each through an idempotent ledger entry tied back to its source.

   Large withdrawals require two distinct approvers before a single cent settles. Requesting a withdrawal holds the funds without changing the total; a rejection releases the hold cleanly.

3. 03

   Encrypted by default

   KYC personal data, 2FA secrets and withdrawal destinations are encrypted at rest with AES-256-GCM. We store ciphertext, never plaintext.

   KYC personal data, 2FA secrets and withdrawal destinations are encrypted at rest with AES-256-GCM. We store ciphertext, never plaintext, and only an authorized reviewer can decrypt what they must.

   Uploaded documents are gated behind short-lived, signed URLs, so sensitive files are never left openly addressable.

4. 04

   Hardened end to end

   Distributed rate limits, CSRF protection, short-rotation sessions and idempotent money flows protect the surface from deposit to payout.

   Distributed rate limits, CSRF protection and short-rotation sessions harden the surface against abuse, while every money-moving operation is idempotent and wrapped in a database transaction.

   Because money flows are atomic and keyed, a retried request or replayed webhook can never double-credit — the platform is defensive from deposit to payout.