Security & reliability
Controls you can verify, not slogans.
Access control
Server-enforced role permissions, strict tenant isolation, hashed API keys with rotation and revocation, lockout and rate limits.
Request integrity
HMAC-signed provider callbacks and webhooks with timestamp windows, single-use nonces and replay protection.
Financial integrity
Idempotent, atomic, row-locked wallet operations and an append-only ledger protected by database triggers.
Observability
Correlation IDs, redacted integration logs, audit trail, health and readiness endpoints, metrics.
Operational safety
Bounded retries with backoff, dead-letter tracking, documented backup and recovery procedures.
Transparency
We publish no uptime or throughput figures that have not been measured.
This project has not undergone an independent security audit or penetration test. See the production-readiness assessment in the repository for open items.