Public ledger

Every payment is recorded. Refunds are recorded as compensating events. Private payment information stays private. Readable by anyone, no login.

• Verified payment webhook. A row is written only after a signed webhook from the payment provider is checked server-side. A redirect back to the site is never treated as proof of payment.
• Append-only event history. Rows are never edited or deleted.
• Refunds are compensating events. A refund does not remove the original row, it adds a negative entry that references it.
• No private data: billing details, email, and payment-processor internals never appear here.