Security & trust model
Clear custody boundaries
TradeShip Pay stores trade agreements, evidence, and decisions. It does not receive or hold client funds. All settlement execution in this demonstration uses a mock provider.
Authentication and isolation
Better Auth handles password hashing and persistent sessions. Server-side organization checks and role checks protect application data. API and invitation secrets are hashed; webhook signing secrets are encrypted at rest.
Customer provider credentials
Authorized provider credentials use AES-256-GCM envelope encryption with a separate random data key per save and a versioned wrapping key in Cloudflare Worker secrets. OAuth uses single-use, tenant-bound state and PKCE. Trial API keys are hashed and shown only once. Disconnect removes stored provider credentials; revoke access at your provider to cancel authorization globally.
An inspectable record
High-value domain changes commit together with a hash-chained audit event. Accepted terms and decision records have database immutability guards. Evidence files have SHA-256 digests. This is not an independently anchored tamper-proof ledger.
MVP boundaries
This software has not undergone an independent penetration test or compliance certification. Production onboarding, email verification, provider due diligence, disaster recovery, and malware scanning require additional implementation and operational review.