Every decision, in a chain nobody can quietly edit.
Each record carries the hash of the one before it, so editing or dropping any row breaks every hash that follows; with a signing key each record is also HMAC-signed. Decisions, approvals, policy changes, Toolkit orders, settlements from PayPal and money that moved outside the firewall are all links in the same chain, and every decision names the hash of the policy it was judged under.
Audit chain
no decisions yet"Verify chain" re-checks the whole history. Money that leaves the PayPal account without a SafePay decision (a PayPal webhook or "Reconcile with PayPal" finds it) is chained as an outside link and the operator is alerted. "Tamper (demo)" shows what verification reports if a row were edited, on a copy; "Verify chain" re-checks the real one.
Click a link to open the checks it was judged on, its seal and the hashes that tie it to the one before. Click any chart to filter the ledger. The Act column is the operator's desk: approve or reject a held payment, or freeze an agent, from its row.