Audit & governance
The controls that make everything else believable. Administrative actions, complaint histories and accounting entries are append-only at the database level — which applies to administrators too — and AI is bounded away from every decision that affects a person.
What it does
Append-only audit log
Administrative actions are recorded and cannot be edited or deleted afterwards, including by an administrator. Enforced by trigger.
Complaints with moderated disclosure
An append-only case history, and a controlled path to telling the respondent — so nobody is confronted with an allegation without context.
Permissions in the database
Row-level security on every table. Authorisation is not the absence of a menu item.
Private document storage
Ghana Cards, selfies and financial documents live in private buckets, reached only through short-lived signed URLs, never public image URLs.
Bounded AI
AI cannot reject a tenant, approve a payment, deduct a deposit, terminate a lease or alter a posted entry. Deposits are never deducted on an AI classification alone.
Account suspension
Suspension is a recorded decision by a person, with a reason, reversible and attributable.
How it works
The sequence an operator actually follows, not a feature list rearranged into steps.
- 1
Every privileged action writes an audit record as it happens.
- 2
Complaints accumulate an immutable history as they progress.
- 3
Disclosure to a respondent is a deliberate, recorded step.
- 4
Corrections everywhere are additive — reversals and new entries, never edits.
What the database guarantees
These hold whether or not the interface remembers to check.
- Audit entries cannot be edited or deleted, by anyone.
- Actor attribution survives: the platform refuses deletions that would blank who did what.
- Sensitive documents are never served from public storage.
What it does not do yet
You will ask this in an evaluation, so here it is without being asked.
- No customer-facing audit export or SIEM integration.
- No formal certification — the controls are real and inspectable, but not third-party audited.
Works with
These share the same database, so nothing is re-keyed between them.