What protects your money, and what proves what happened
You are being asked to route a six-figure payment through a company you have not met. These are the mechanisms that make that reasonable, described as plainly as we can.
You gate every tranche on evidence you chose
You set, up front, the document that releases each tranche — a signed PO, an inspection report, a bill of lading. From then on the gate is fixed: a tranche cannot be released until its evidence is in and you approve it. Payment execution launches with a licensed payment provider; today Tranchio records the release decision, it does not move funds.
It is why Tranchio is deliberately the control layer, not the bank: what it holds is the record — every release decision made against evidence and your approval. Moving the money is a licensed provider's job, and that part goes live at launch.
Documents are fingerprinted on arrival
Every evidence file is hashed with SHA-256 the moment it is received, and the server independently recomputes that hash against the stored object rather than trusting what the uploader claimed. Verified, unverified and mismatched are three distinct states, because a mismatch is the thing you would most want to know about.
In a dispute, the question is whether the document under discussion is the one that was actually submitted. A hash recorded before anyone had a reason to argue answers that.
The record is written with the change
Every state transition writes an audit entry in the same database transaction as the transition itself. There is no path by which an order changes state without a line in the record, because the two either commit together or neither does.
Both parties read the identical trail, and either can export the whole thing as a single file at any time, without asking us: contract, documents, hashes and history.
Access is by invitation, and derived from the contract
There is no self-service signup. Being able to prove you own an email address is not by itself a right to see anyone's purchase orders. Whether you may act on a contract is worked out from the contract, which names the buyer and the seller, rather than from any claim in the request.
Which side you are on decides what you can do. A seller cannot approve their own work, and a buyer cannot submit evidence on the seller's behalf. Those rules are enforced where the lifecycle is defined, not in the interface.
Common questions
- Does Tranchio hold my money?
- No — Tranchio never takes custody of your funds, and today it does not move money at all. It is the control layer, not a bank. Payment execution launches with a licensed payment provider; none is engaged yet, so no funds move through Tranchio right now. What runs today is the release decision: when a milestone is backed by evidence and you approve it, Tranchio records the instruction to release that tranche, and at launch that instruction is what the provider acts on. Tranchio does not lend against your order.
- What happens to my documents?
- Every file is fingerprinted with SHA-256 when it is received, and the server independently recomputes that fingerprint against what was actually stored. A mismatch is recorded as a mismatch rather than ignored. You can export the complete set at any time, with the fingerprints, and anyone can recompute them.
- Can Tranchio change the record after the fact?
- Every state change writes an audit entry in the same database transaction as the change itself, so there is no state an order can reach without a corresponding line in the record. Both parties see the identical trail, and either can export it. A record only one side can read would be worth very little in a disagreement.
- Who can see my orders?
- Only people invited into your organization. There is no self-service signup, and an email address alone is never sufficient to see anyone's purchase orders. Authorisation is derived from the contract itself rather than from anything the caller asserts, so a buyer cannot claim seller permissions by asking.
What you can rely on
- Security here is a property of how the code works, not a policy we promise to keep. The three guarantees below hold because the system cannot do otherwise. An independent certification is scheduled, and we will publish the result.
- A determination rests on the evidence, not on anyone's view of the deal. The release gate is the one both sides agreed at the start: the documents you specified, submitted and verified. Because it was fixed in advance, neither side can move it after the fact.
- Verification runs through a licensed payment partner against the public register, to the standard a regulated institution is held to, with the outcome recorded on the order. No partner is engaged yet, so this goes live at launch.
- Paying out in tranches against proof removes the largest risk in the trade: paying for work that has not been done. You choose the seller; the structure makes sure that, once you have, the money follows the evidence.
Or read how your corridor settles first.