One auditable ledger

Deposits, returns, commissions and withdrawals are all just signed entries appended to one log. Balances are computed from that log, so they can always be re-derived and proven. Three properties hold for every entry.

• Atomic

  A balance change and its transaction entry land together, inside one database transaction, or not at all.

• Idempotent

  A retried publish or replayed webhook can never double-credit — idempotency keys deduplicate the write.

• Auditable

  Every entry stores a signed amount and a balance-after snapshot, so any state can be re-derived and proven.

1. 01

   Balances are derived, never stored

   Your balance is not a number someone can edit. It is the running total of an append-only, double-entry transaction log — the same primitive banks have used for centuries, made transparent. Because the total is computed from the log, it can always be recomputed and reconciled against every entry that produced it.

2. 02

   Corrections are new entries, not edits

   Nothing in the log is ever changed in place. If something needs to be corrected, a new, offsetting entry is appended. The original stays exactly where it was, so the full history remains intact and every past state of the account is reconstructable forever.

3. 03

   One log for every money movement

   Deposits, weekly returns, IB commissions and withdrawals are all just signed entries on the same log. There is no separate, hand-maintained balance to drift out of sync — a single source of truth carries the entire money story of the account.

4. 04

   Reviewed, then published

   Returns and commissions are drafted, reviewed, and only credited on publish, each via an idempotent entry tied back to its origin. Large withdrawals require two distinct approvers before settlement — the ledger records the hold, the approval and the settlement as distinct, provable steps.

• Deposit

  A confirmed deposit is credited through the ledger, creating a permanent, signed entry. An idempotency key means a double-submit can never double-credit.

• Return

  Published weekly returns append an idempotent credit tied back to the originating return batch — never an auto-applied mutation.

• Commission

  IB commissions follow the same draft → review → publish loop and post as their own entries, feeding tier progress.

• Withdrawal

  Requesting a withdrawal holds funds (available → locked) without changing the total; payout settles the debit atomically, a rejection releases the hold.

These describe the platform, not investment returns.

• WeeklySettlement cycle
• 100%Balances on-ledger
• AES-256Encryption at rest
• 2-of-NLarge-payout approvals
• DailyReconciliation
• IdempotentMoney flows