Money and messages move on verified rails.

Channel and payment credentials are encrypted at rest on the server. Each secret class has its own encryption key, and startup refuses to boot if two classes share key material.

Per-class key separation enforced at boot

The desktop app holds access tokens in memory and refresh tokens in an httpOnly cookie. Nothing sensitive is written to localStorage, sessionStorage, SQLite, or any file. Verified in the packaged runtime.

Verified in the packaged runtime

Every message and payment event is signature-verified over the raw body before parsing, checked in constant time, deduplicated, and processed exactly once with replay safety by construction.

Constant-time comparison, dedupe keys

Every record is scoped to its organization, and every query checks that boundary. Isolation tests run on every change.

Isolation tests run on every change

The audit log is append-only and immutable: no update or delete routes exist. Customer, order, product, broadcast, ticket, and permission mutations all write structured audit events with actor and timestamp.

Append-only; no update/delete routes exist

Production rejects insecure default settings, refuses to enable live sends without explicit operator flags, and blocks dev seeds outside development. Safe defaults are enforced by the config layer itself.

Config layer refuses insecure defaults