Trust · Data integrity
Trust by construction, not by promise.
Money is only as trustworthy as the records behind it. Append-only ledgers, database-level immutability, and exactly-once movement mean every state change is recorded, and every balance reconciles to the ledger entries behind it.
- 01project.createdDEAL-8842 · draft
- 02escrow.locked+GHS 42,000 · milestone 1
- 03milestone.provendelivery evidence accepted
- 04escrow.released−GHS 42,000 → payee
- 05project.settledDEAL-8842 · immutable
Rows are written once, never edited, never hard-deleted.
How it holds
Six properties that make the record trustworthy
Every movement is a ledger entry
Money never moves without a ledger entry recording it. An entry's amount is never rewritten, so what was paid, locked or released is a matter of record rather than something that can be quietly adjusted.
Database-level immutability
The audit trail is immutable in the database itself, not left to application code that could be bypassed or carry a bug: the database refuses to update or delete an audit row, whoever asks.
Soft-delete with audit survival
Removing an object hides it from view without erasing its history. The ledger entries and audit trail behind it survive, so a deletion can never quietly rewrite what happened.
Exactly-once money movement
Each release is idempotent at the point it commits. A retried request cannot double-move funds, a release either happens once and is recorded, or it is rejected.
Ring-fenced per project
Money committed to a project is set aside against its milestones and released only when the work is signed off. Nnarksup does not lend it, invest it, or spend it, and cannot move it outside that sequence.
Tamper-evident by construction
The audit trail is trustworthy because of how the system is built. Every party sees the same immutable history, the foundation the platform's guarantees rest on.
Responsible disclosure
Found a vulnerability? Tell us first.
We welcome reports from security researchers. Report an issue privately, give us reasonable time to remediate before disclosure, and act in good faith, don't access data beyond what's needed to prove the finding, and never degrade the service or another user's data. We'll acknowledge your report and keep you posted through the fix.
- Report privately, not publicly
- Reasonable time to remediate
- No data access beyond proof
- Good-faith testing only