Built to be provable.
Tamper-evident audit
Every state change lands in an append-only ledger whose entries are hash-chained. Altering any past record breaks the chain visibly, so the history a regulator reads is the history that happened.
Exact, deterministic math
Money is computed in integer minor units and rates in basis points, with no floating point and one defined rounding step. The same product version yields the same number, indefinitely.
Versioned, signed definitions
A product changes only through an approved, signed version with an effective date. Every loan references the exact version it was made under, so nothing changes silently underneath it.
Strict tenant isolation
Each company's catalog, loans, and ledger are isolated per tenant. API keys are scoped to the tenant and can be rotated and revoked without downtime.
The record, never the money
The platform records what every loan should do and has done. It never holds funds and never touches card data; money stays with the banks and payment providers a company already uses. That boundary keeps the blast radius of any incident narrow by design.
Operational security
- All traffic is encrypted in transit with TLS, and data is encrypted at rest by our infrastructure providers.
- Access to production follows least privilege, and administrative actions are themselves logged.
- Every write to the public REST API carries an idempotency key, and every lifecycle event is delivered as a signed webhook your systems can verify before acting.
- Backups are taken continuously and recovery is rehearsed, so the ledger a company depends on survives ours as well as its own bad day.
Data protection
Personal data on this website is handled as described in the Privacy Policy, including the providers that process it. For customer companies, a data-processing agreement is part of the service agreement, and documentation for a security review is available on request at hello@capcells.com.
Responsible disclosure
If you believe you have found a vulnerability in the platform or this website, write to security@capcells.com with enough detail to reproduce it. We read every report, respond quickly, and fix what is real. Good-faith research is welcome: report privately, avoid degrading the service or accessing data that is not yours, and we will not pursue legal action over it. A machine-readable version of this policy lives at /.well-known/security.txt.