Argon2id password hashing
Passwords are stored with Argon2id and never in plain text.
Security & controls
Controls that survive failure paths
The account experience is designed around clear permissions, verified movement, exact ledger entries, and reconciliation.
Built to be inspectable
Security is a system, not a slogan
These are implemented product behaviours. We do not claim insurance, regulation, or principal protection.
The control set
What each control actually answers
TOTP and session rotation
Optional time-based one-time passwords, with sessions rotated on privilege change.
Maker-checker approvals
Operational changes require a second authorised reviewer before they take effect.
Circuit breakers and reconciliation
Movements are checked against limits and reconciled on a schedule.
Append-only ledger
Every credit, accrual, and withdrawal is written once and kept in order.