Every action explainable. Every delivery provable. Nothing disappears.

An append-only log guaranteed by the database, delivery receipts preserved as legal evidence, and a sending engine with end-to-end idempotency, a reprocessing queue and automatic reconciliation.

Audit and Reliability

Schedule a demo See all features

Immutable audit trail with the action, entity and actor for every event

Append-only

guaranteed by a Postgres trigger

layers of idempotency in sending

10 min

reconciliation cycle

messages silently lost

Reliability guaranteed by architecture, not by a promise

Everything goes into the log

Actor (user, system or job), action, entity, before/after, reason and IP. The database rejects UPDATE and DELETE on the log.

Delivery becomes evidence

A delivered notification can't be deleted, nor can the delivery timestamp or the provider ID — protection aligned with STJ Tema 1.315.

The engine doesn't lose messages

Deduplicated webhooks, state and queue written in the same transaction, jobs with a deterministic key, and a reprocessing queue for failures.

Reconciliation keeps watch

Every 10 minutes, the system compares expected state x queue and corrects discrepancies.

From the immutable log to the reprocessing queue

Append-Only AuditLog

A Postgres trigger rejects any change or deletion of audit records. Not even an administrator can rewrite history.

Actor, action, before/after, reason and IP
Covers the dunning flow, suppressions, disputes, payments and the portal
Queryable from the interface and the API

Protected Delivery Receipt

A delivered notification is evidence: the database prevents deleting it or clearing deliveredAt and the provider ID.

Aligned with STJ Tema 1.315
Channel, template and recipient preserved
Proof of notification for credit-bureau reporting and protest

Webhook Inbox

Every webhook delivery is persisted with a unique idempotency key before processing.

Provider redeliveries deduplicated
Failures remain reprocessable
Nothing processed twice

Transactional Outbox

The state change and the job scheduling are written in the same transaction — either both happen, or neither does.

Dispatcher with a deterministic jobId
The queue deduplicates automatically
No orphaned state or phantom jobs

Pre-Send Revalidation

Milliseconds before delivering to the provider, the worker rechecks payment, cancellation, dispute, suppressions and dunning-flow state with fresh data.

Failed check → suppresses with a reason
Tested under race conditions: a payment with a message already queued doesn't trigger a send
Human-readable reason visible in the interface

Dead-Letter Queue and Reconciliation

A job that exhausts its retries goes to the reprocessing queue with the error attached. Reconciliation fixes discrepancies every 10 minutes.

Nothing fails silently
Detects pending outbox entries and stuck notifications
Fixes out-of-sync runs

Real use cases

"Why didn't this message go out?"

The charge detail shows: step suppressed — payment confirmed 40 seconds before the send. Human-readable reason, timestamp and evidence.

Proof of prior notification

To report a debt for protest, you need to prove you notified the debtor. The delivery receipt — protected against alteration — is the evidence, with date, channel and provider ID.

External audit

An auditor requests the history of a disputed debt. The append-only log delivers the full sequence: charge, dispute, pause, decision and effect — with no gaps.

Notifications with delivery receipt and suppression reasons

Protected delivery receipt and pre-send revalidation: every notification with its status and reason.

Charge detail with the dunning flow's full telemetry

Full dunning-flow telemetry in the charge detail: why every message went out — or didn't.

Frequently asked questions

Trust is built with architecture

See the telemetry, the audit log and the reliable sending engine in action.