Maker-checker
Whoever creates or changes a withdrawal can never approve it. The attempt is blocked and logged.
TESTED · try it as Omar on WD-1002
Withdrawal controls your finance team can inspect.
A back office for a fictional broker that handles the hard part of money movement: holds, maker-checker approvals, failed payouts, provider callbacks, partner commissions and reconciliation. Every rule is enforced on the server, and every business action, allowed or blocked by a control, is recorded in the audit trail.
No sign-up. Your own private copy of synthetic data. Access expires after 24 hours; the data is then removed by routine cleanup.
What it proves
Controls a broker's auditor actually asks about.
Each one is built into the server, covered by an automated test, and something you can try yourself in the demo.
Approvals expire on change
Each approval is tied to a fingerprint of amount, beneficiary and version. Change anything and it is void.
TESTED · edit an approved withdrawal
Duplicate callback protection
Identical provider callbacks and simultaneous clicks post one payout. Conflicting or late reports are held for a compliance decision.
TESTED · send with a duplicate callback
Failures handled
Rejected payouts land in an exception queue. Retry when fixed, or reverse to return the funds.
TESTED · WD-1004 is waiting
Append-only ledger
Double-entry, integer cents, every transaction sums to zero. The database refuses edits and deletes.
TESTED · reconciliation stays matched
Four roles, five staff
Support, Finance (two officers), Compliance and Admin. Admins cannot move money; holds need a compliance note.
TESTED · switch person at the top right
How a withdrawal moves
A controlled withdrawal workflow.
Each money-moving step is a compare-and-set on the server: the wallet, KYC and investigation checks, the ledger rows and the audit entry are part of the same database transaction as the state change.
Built like production
Engineering you can inspect.
- RuntimeCloudflare Pages Functions API with a D1 (SQLite) database
- IsolationA disposable workspace per visitor; resets touch only your copy
- MoneyInteger cents, append-only double-entry ledger, live reconciliation
- Sessions256-bit tokens stored hashed, HttpOnly SameSite=Strict cookies, rotation on sign-in, CSRF token on every change
- AuditActor, action, object, result and correlation ID, including blocked attempts; CSV export
- AccessibilityKeyboard friendly, light and dark themes, checked with axe-core on desktop and mobile
Automated acceptance suite
216 / 216
automated checks passing in our local run for this build (Cloudflare D1 emulation), including race, failure-injection and tampering tests
- Maker, support and admin cannot approve
- Stale or changed approvals are refused
- Two independent approvers at $10,000+
- Concurrent double-approve and double-send apply once
- Duplicate callbacks post one debit
- Overdraw attempts leave no ledger rows
- One workspace cannot touch another
- Old sessions revoked; bad CSRF tokens refused
- A failure after callback receipt, then replay, settles once
- Late callbacks cannot complete a newer attempt
- KYC changes after approval block payout
- Conflicting or late provider reports block retry until one compliance decision is recorded
- Misallocated partner balances and tree loops are detected
- Partner commissions reproduce line by line; reruns never pay twice
- Database rejects edits to ledger and audit
Known limitations are listed openly inside the demo under "How it's built".
See every control for yourself.
Open a private workspace, switch between five staff members in four roles and follow the guided walkthrough. It marks each step as you complete it.