Quantum safe by default.
Every request, response, rail message, and ledger checkpoint is signed with post quantum cryptography, and the ledger's history can be proven unchanged.
| What | How it is protected |
|---|---|
| Channel requests | ML-DSA-65 (FIPS 204) signature over method, path, time, nonce, and body; five minute window; replays refused |
| Hub responses | ML-DSA-65 signed; channels refuse any response that does not verify |
| Rail messages | ISO 20022 and NACHA messages signed by the hub and stored with the payment |
| Ledger | Append only, SHA-256 hash chained, ML-DSA-65 signed checkpoints |
| Connections | TLS 1.3 with hybrid X25519MLKEM768 key exchange first |
| Secrets at rest | AES-256-GCM |
| Directory | Phone and email stored as hashes; account tokens, never account numbers |
Members
- Passkey, Face ID, or password again for larger payments and new payees
- The verified legal name is shown before every payment
- Scam warnings at the moment of payment, not after
- Cooling periods you can cancel on risky first payments
Operations
- Every status change and decision kept in an append only audit log
- Agents limited by ceilings in code and hard dollar limits
- Redundant nodes, standby database, and no lost payment messages
- Each credit union keeps its own books inside the hub, balanced on every entry