Platform
Built for the auditor who has not walked in yet
In a system that moves money between trading partners, the control environment is not a compliance overlay — it is the product. Every material action has an approver, a policy and a record.
Controls
What is enforced, and where
Enforcement lives as close to the data as possible. Controls implemented only in the user interface are suggestions.
RBAC + ABAC authorisation
Role-based and attribute-based rules together, granular enough to separate who may adjust, reverse, approve and settle on the same object.
SSO / OIDC and MFA
Enterprise identity from day one, with per-tenant login modes and multi-factor enforcement.
Row-level tenant isolation
Isolation enforced in the database rather than in application code, so a bug in a query cannot cross a customer boundary.
Encrypted secret vault
Every integration credential stored once, referenced by name and resolved server-side. Nothing is pasted into a config screen.
Audit trail
Changes logged with actor, timestamp and prior value, and every AI exchange recorded with exactly what was sent to the model.
Job trace
Every engine run records its decision path, so a number produced three months ago can still be explained.
Approval workflows
Multi-step approvals any object can opt into, gated at the point money becomes irreversible.
Period locks
Every engine validates against the accounting calendar before writing, so a closed period stays closed.
Sovereign deployment
A dedicated single-tenant private cloud with data-residency controls for customers who require it.
Read-only SQL for tenant queries
SQL your own people author — reports, dashboard tiles, previews — runs under a database role that can only read, behind a guard that parses each statement first. Two walls, because one is a single mistake away from none.
Deletion that revokes access
Permanently removing a user sits behind its own entitlement, separate from the right to deactivate. It revokes live sessions and any unused invitation or password link, and retains the audit history — because deleting an account must not rewrite what it did.
A guard on every door
Every API endpoint that changes data carries an explicit permission check, and an automated audit fails the build if a new one ships without — so “someone forgot” cannot reach production.
Segregation of duties
Conflicting rights — create versus approve — are blocked when roles are saved, and access reviews have owners re-certify who holds what.
Only the author removes it
A note, a file or an approval in flight can be removed by the person who added it or an administrator — nobody else.
AI with no access of its own
Assistants work inside the asking user’s session and company workspace, read the screen with that user’s access, and propose rather than change records.
One live password link
Using an invitation or reset link cancels every other outstanding link for that account, so an older email forwarded or left in an inbox is already dead.
Segregation of duties
The analyst accrues. Finance settles.
Adjustments are the mechanism by which an accrual can be made to say anything, which is why the person who can adjust must not be the person who can settle.
In incentive programmes the natural split is that an analyst computes, adjusts and prepares, while finance reviews, approves and settles. Where one role does both, the control failure is not hypothetical — it is the single most common finding in a rebate audit.
Enforcing it requires authorisation granular enough to treat adjust, reverse, approve and settle as separate permissions on the same object, rather than one “edit” right. That is what RBAC combined with attribute-based rules gives you: not just who the person is, but which entities, agreements and value bands they may act on.
The audit trail then makes it demonstrable after the fact, and the job trace makes the engine’s own decisions demonstrable too — because “the system calculated it” is not an acceptable answer to an auditor.
Send us your security questionnaire.
We would rather answer it before the demo than after. Architecture, isolation model, data residency options and audit capability — happy to go into detail with your security team.