Trust
How we hold your money and your data.
Written to be read by your security reviewer. Every claim here is checkable against the code, and each one says where.
Escrow
Where campaign money sits
Your money is held before work starts, not after.
Funding a campaign posts to a campaign escrow account. Creators can only be hired against money that is already there — an offer above the available balance is refused, not queued.
apps/api/src/modules/finance/funding.service.ts
Money is committed to a creator the moment they are hired.
Hiring reserves the agreed amount, so the same shilling cannot back two collaborations. The reservation is enforced by a database constraint, not only by application code.
apps/api/src/modules/finance/earnings.service.ts
Release happens on acceptance, and only then.
A creator is paid when you accept their work — or automatically if nobody reviews it within five business days, which is what stops a silent buyer holding a creator’s payment indefinitely.
apps/api/src/modules/content/review-sla.service.ts
A shortfall refund comes out of money that was never spent.
Guarantee settlement compares promised units against accepted ones and returns the proportional creator value. It never claws back a payment already released to a creator.
apps/api/src/modules/packages/settlement.service.ts
The ledger
Why immutability matters to you
A platform that can edit its own financial history can tell you anything. Ours cannot edit it, which is the only reason our numbers are worth more than our word.
Every movement is two entries that sum to zero.
Money is never created or destroyed by a request — it moves between accounts. A transaction whose postings do not balance is rejected by the database before it can be written.
apps/api/src/modules/finance/ledger.service.ts
Posted entries are immutable.
A correction is a new reversing entry, never an edit. A trigger refuses updates and deletes on posted rows, so history cannot be rewritten by anyone — including us.
apps/api/src/database/migrations (ledger triggers)
Balances are projections, not the truth.
Every balance you see can be rebuilt from the postings. If a projection ever disagreed with the ledger, the ledger wins, and a reconciliation job reports the drift rather than hiding it.
GET /v1/finance/reconciliation
A commanded payment happens at most once.
Every money-moving command carries an idempotency key. A retried request, a replayed webhook or a double-clicked button posts once.
apps/api/src/platform/idempotency.service.ts
Provenance
Estimated, or measured — never blurred
Every figure in the product carries where it came from.
A number is labelled measured only when it came from a platform account a creator connected. Anything modelled is labelled estimated, and anything self-reported is labelled self-declared. The labels appear beside the figure, not in a footnote.
This costs us. An estimate presented as a measurement looks more confident, and confidence sells. But a buyer who later discovers which numbers were modelled stops believing all of them, including the ones that were real — so we label them and accept looking less certain than a competitor who does not.
Where a sample is too small to say anything useful, we say that instead of widening a range until it is technically true. A forecast over three creators is noise wearing a number’s clothes.
Data
What we store, and what we do not
We store
- Public profile details a creator gives us: handle, name, city, languages, interests, occupation.
- Channel metrics from the platforms a creator connects: followers, median views, median interactions.
- Aggregate audience breakdowns: age bands, gender split, country shares, credibility — as percentages, never as people.
- Campaign history: what they delivered, when, and whether it was on time.
We do not
- Individual members of a creator’s audience. We hold distributions, never lists of people.
- Inferred audience income. It is rarely accurate, and filtering on it edges toward exclusionary targeting — so we do not collect it and you cannot filter by it.
- Full bank account or mobile money numbers. Those live with the payment provider; we keep the last four digits for you to recognise.
- Private messages or content from a creator’s connected accounts.
Payment rails
What is live, and what is not
The same live-and-planned distinction as the rest of the site. A rail we have not shipped is listed as planned, not implied as available.
| Market | Currency | Status |
|---|---|---|
| Kenya | KES | Live |
| Nigeria | NGN | Planned |
| South Africa | ZAR | Planned |
| Ghana | GHS | Planned |
| Uganda | UGX | Planned |
Payouts in Kenya go to M-Pesa and bank accounts through our payment provider. A new payout method waits a short while before it can receive money — if someone takes over a creator’s account, that window is what stops them redirecting earnings before anyone notices.
Reviewing us for an enterprise engagement? Tell us what you need to see and we will answer specifically rather than send a PDF.