A platform that releases payments is a control platform or it is useless. That is why the control level does not sit beside the modules but underneath all of them: identity, permissions, segregation of duties, limits, audit trail and data quality apply the same way everywhere.
Entity, period, source and the transaction it arose from.
Not an email without an addressee, but a case with a name and a date.
Checked at the moment of the decision, per entity, amount and transaction type. An approval for step A is not an approval for step B.
Origin, basis, decision and outcome stay retrievable together.
An internal control system does not live on its description but on its running state: executed, evidenced, open — per period and entity.
Sensitive records stay within the circle that needs to know. Whoever joins, joins traceably.
The control level is part of the architecture, not a module. A second module brings no second control logic with it.
This is the point where we can evidence the most — which is why it sits here rather than in a list.
The server-side approval control was observed running in a controlled environment, by a party independent of the implementation.
This list is not small print. It is the reason the rest of this page can be trusted.
The audit trail is tenant-scoped and append-only in operation. Immutability is an open requirement in our own delivery — we mark it rather than promise it.
We claim no certification and no proximity to one. If your review process needs evidence, we tell you what exists today and what does not.
The approval is evidenced control. Transmission to the bank and the status response are a target process and are not presented as present.
Retention and procedural questions are yours to settle with your auditor. We provide the mechanism, not the legal assurance.
It complements them. Permissions in the posting system govern who may post there. This level governs who may decide on a transaction that touches several systems — and keeps the decision on the transaction.
A case is created and no approval. That is the default and not the exception: where there is doubt, nothing is approved.
Yes, per tenant. The matrix is validated server-side against the tenant's roles — not filtered in the interface.
It supplies its running state. An internal control system describes which controls should apply; this level shows which ones were executed this period, what evidence they carry and which exception is open. The chain for that is on internal controls.
We carry the mechanics for it as a defined capability: sufficiency of evidence, a judgement with a basis, a risk register. What we can evidence today is the server-side check of the approval. An audit opinion is your auditor's to give, not a system's.
It is not overwritten but corrected: the new decision stands beside the old one, with a reason and a timestamp. Reversibility is an operating principle — a transaction you cannot take back without losing the trail is not a controlled transaction.
If your request comes from a security or audit context, send us your questionnaire. We answer yours rather than sending ours, and we state clearly what we can evidence.