One permission check
Screens, tokens and the assistant all pass the same server check.
Security
Every action checked. Every change named.
Checked on the server, recorded forever, and two people for money.
Closed by default
Every closed route is called without sign-in on every change.
Codes where it matters
Single sign-on. Codes required for admins and finance.
Every change named
Who, role, reason, and whether the assistant did it. Kept forever.
Who looked
Every record opened and file downloaded, by people, the assistant and API tokens.
Two people, one lock
Refunds, journals, EFT runs, bank changes and rates need a second approver.
Never touch MutualOS
Typed into the processor's fields. We keep a token.
In once, never out
Keys are sealed and never shown again.
In Canada
Your own database. Test copies reach only testers.
Independent review
We look for our own holes.
An adversarial review in October 2026. Serious findings fixed, each with a test so it cannot return.
| Control | What | Status |
|---|---|---|
| Code and security review | Findings fixed or tracked to closure. | Done |
| Sign-in codes | Required for admins and finance. | Built |
| Money under lock | Refunds and reversals cannot pay twice. | Built |
| Penetration test | Before a customer's first real policy. | Coming |