Platform
Built for the auditor who has not walked in yet
In a system that moves money between trading partners, the control environment is not a compliance overlay — it is the product. Every material action has an approver, a policy and a record.
Controls
What is enforced, and where
Enforcement lives as close to the data as possible. Controls implemented only in the user interface are suggestions.
RBAC + ABAC authorisation
Role-based and attribute-based rules together, granular enough to separate who may adjust, reverse, approve and settle on the same object.
SSO / OIDC and MFA
Enterprise identity from day one, with per-tenant login modes and multi-factor enforcement.
Row-level tenant isolation
Isolation enforced in the database rather than in application code, so a bug in a query cannot cross a customer boundary.
Encrypted secret vault
Every integration credential stored once, referenced by name and resolved server-side. Nothing is pasted into a config screen.
Immutable audit trail
Every change logged with actor, timestamp and prior value — and retained, not rotated away.
Job trace
Every engine run records its decision path, so a number produced three months ago can still be explained.
Approval workflows
Multi-step approvals any object can opt into, gated at the point money becomes irreversible.
Period locks
Every engine validates against the accounting calendar before writing, so a closed period stays closed.
Sovereign deployment
A dedicated single-tenant private cloud with data-residency controls for customers who require it.
Segregation of duties
The analyst accrues. Finance settles.
Adjustments are the mechanism by which an accrual can be made to say anything, which is why the person who can adjust must not be the person who can settle.
In incentive programmes the natural split is that an analyst computes, adjusts and prepares, while finance reviews, approves and settles. Where one role does both, the control failure is not hypothetical — it is the single most common finding in a rebate audit.
Enforcing it requires authorisation granular enough to treat adjust, reverse, approve and settle as separate permissions on the same object, rather than one “edit” right. That is what RBAC combined with attribute-based rules gives you: not just who the person is, but which entities, agreements and value bands they may act on.
The audit trail then makes it demonstrable after the fact, and the job trace makes the engine’s own decisions demonstrable too — because “the system calculated it” is not an acceptable answer to an auditor.
Send us your security questionnaire.
We would rather answer it before the demo than after. Architecture, isolation model, data residency options and audit capability — happy to go into detail with your security team.