Every action an administrator takes — approving or rejecting a transaction, reviewing a KYC submission, adjusting a rate or limit, changing a team member's permissions — is written to an append-only audit log, including who performed it and when.

Fraud and security signals the platform detects on its own — a mismatched name, a duplicate reference or screenshot, a sudden IP change, repeated failed KYC attempts, or a sanctions-list match — are recorded in a distinct, equally permanent log, whether they only flagged a transaction for review or blocked it outright.

Both logs are append-only: entries cannot be altered or removed after the fact. This is what allows us, and where legally required a regulator or auditor, to reliably reconstruct the history of any account or transaction.