PanoQore is built for the review a partner bank, an auditor or a regulator will run. The controls below are enforced by the engine itself, not by the console or by policy documents.
Every event is chained to the one before it by hash, and the chain head is signed hourly with a key PanoQore itself can’t read. Change one past event and verification fails at exactly that link.
Auditors run the same check with the panoqore verify CLI against an export, without access to the live system.
The application can only insert and read journal, postings and events. A database trigger allows a pending entry to become posted or voided, and nothing else.
A per-tenant hash chain over every event, with the head signed hourly by an Ed25519 key held in a KMS outside PanoQore. An optional daily anchor to Base arrives in v2.
Adjustments, freezes, limit and overdraft changes need a second person. The approver can’t be the proposer, and large changes need two approvers.
Accounting periods open and close per tenant. Postings dated into a closed period are rejected, and late items are flagged for review.
Reading account history above a volume threshold is itself an audit event, so you can answer who looked at which customer’s money.
Row-level security is forced on every tenant table and tested at the API and SQL layers. API keys and Kafka topics are scoped to one tenant.
API keys are hashed with argon2id, scoped, and rotate with an overlap window. Signing keys sit behind a Signer port outside the service.
Synchronous replication to a standby, 30 days of point-in-time recovery, and logical backups to WORM storage with a quarterly restore drill.
Journal, postings and events are kept at least 7 years. Partitions older than 2 years move to WORM storage and stay queryable.
PanoQore is infrastructure, not a licensed institution. These are the obligations it helps you and your partner banks evidence.
| Regulator | Through | What PanoQore provides |
|---|---|---|
| CBN | Your licensed partner banks as account issuers | Transaction records, audit trail, daily reconciliation evidence per partner, data localisation in Nigeria |
| NDPC | Each product, as data controller | No personal data in the ledger. Owner references are opaque; metadata is schema-checked so names and phone numbers can’t enter |
Write to security@panoqore.com with steps to reproduce. We reply within one business day and never pursue good-faith research.