- Architecture
- Multi-tenant, API-first cloud platform; separate member, operator and administrator zones over one core, with per-tenant isolation enforced in the database itself.
- The record
- Every balance — points, prizes, collectibles and cash — sits on a purpose-built double-entry ledger with two-phase escrow transfers and ledger-enforced non-negative accounts.
- Verification
- Every promotion publishes proofs an outsider can re-run to confirm the recorded outcome, with no account. The audit chain’s head is timestamped by an independent RFC 3161 authority where one is configured — and the public page reads “pending” rather than claiming a timestamp that has not been issued.
- Intelligence
- A rules-based decision engine, not a learned one: it reads a brand’s own trading data, surfaces where revenue is leaking, ranks the opportunities by size, and can launch the matching campaign inside budget, discount and authority limits.
- Integration
- Inbound event API with per-tenant keys, signed-token QR, HMAC-SHA-256-signed outbound webhooks, an embeddable white-label widget, W3C Web Push, and an unauthenticated public read API for verification.
- Security
- OAuth 2.0 single sign-on, role-based operator and administrator access, row-level tenant isolation, AES-256-GCM on stored integration secrets, append-only audit records, data exportable on demand.