Institution isolation
Every private aggregate and command is scoped by institution and environment, with repository authorization and row-level security as defense in depth.
Protect authority, financial truth and institutional separation.
Karvo secures the full command path: who may act, which institution and environment they represent, what data they may access, and which evidence permits a financial state to change.
Architecture principles / 01
Controls that can be tested and operated.
Scoped credentials
Machine keys bind institution, environment, permissions, expiry and revocation; plaintext tokens are returned once and never stored.
Encryption and keys
TLS protects external traffic; sensitive data uses envelope encryption and signing, provider and Fabric keys remain separated.
Data minimization
Personal documents remain encrypted off-chain. Events, audit records and Fabric commitments contain only the minimum required evidence.
Immutable audit
Actors, authority, policy, outcome, reason and correlation identity are recorded without logging secrets or raw sensitive documents.
Safe callbacks
Webhooks use raw-body HMAC signatures, timestamp windows, versioned secrets, event deduplication and controlled egress.
Financial integrity
Balanced postings, permanent command IDs, explicit provider certainty and reconciliation prevent availability failures from becoming economic errors.
Operational observability
Traces, metrics and allowlisted logs follow transaction, provider, ledger, settlement and reconciliation state end to end.
Failure handling / 02
Availability must never override financial correctness.
Detect
Identify a timeout, stale state, invalid callback, invariant breach or evidence mismatch.
Contain
Stop unsafe progression and preserve the permanent command and transaction identities.
Classify
Represent exactly what is known: rejected, accepted, failed, unknown, disputed or requires review.
Repair
Query authoritative state, replay the same idempotent command, attach evidence or propose an approved reversal.
Reconcile
Compare independent records before restoring finality or closing the operational case.
Work with Karvo
Review security and data requirements
Tell us where your institution sits in the transaction chain and which corridor or capability you are evaluating.
Start a conversation