Trust

Nothing happens that you didn't approve, and everything leaves a receipt.

What we do

Approvals are bound to what you saw. An approval records the exact inputs you were shown. If the amount or the recipient changes before the action runs, the approval no longer applies and you are asked again.
Approvals are single-use and can expire. The same approval cannot be replayed, and a stale one can be made to lapse after a period you set.
A sent message is not "done" until it is verified. If the outcome is uncertain (for example a timeout after a possible send), the item is held as "unknown" and checked against the provider before anything is retried, so a customer is not messaged twice.
An agent's claim of success is not proof. Results from real providers are confirmed by an independent check.
The event log is tamper-evident. Each mission's events are hash-chained, so an edited, deleted or reordered event is detected. (Today this covers the file and in-memory stores; database backends are not chained yet.)
Publishing needs a real, scoped approver. A credential that is valid is not enough: it must belong to the right account and hold the grant for the channel.

What is simulated

The default install runs in shadow mode: actions are staged for approval and sends are simulated until you connect real accounts. Screens on this site that show sample data say so.

What is not built yet

Per-person approver identities (today an approver credential is per tenant).
The mission path's "unknown outcome" state (it exists for sends in Today and the external-agent path).
Wiring detections to alerts in Edge sentinel.
A signed desktop installer for Windows and macOS.

Licence, in plain words

Our software is source-available: AGPL-3.0-or-later with the Commons Clause. You can read it and run it for your own business; the Commons Clause removes the right to sell it. It is not open source. This wording is being reviewed by counsel, so treat it as a draft until we say otherwise.