What Revient can prove.

The connection asks for read permissions only. There is nothing in it that can change an order, issue a refund or take a payment.

What enforces it: Every permission Revient requests begins with read. The one exception is registering the notifications Revient listens to, which goes through a single audited channel that can send exactly two operations and nothing else. A test asserts the read-only rule against the real permission list rather than against this sentence.

Nothing is retrieved until you connect the store yourself, and you can disconnect it from your workspace.

What enforces it: A store is reached only through a connection your workspace owns. Disconnecting stops further retrieval; it does not delete the case history you have already been shown, because that record is also your evidence.

Fields are retrieved against a stated purpose and held under a stated retention class, rather than swept up and kept in case they are useful later.

What enforces it: Each field a query may read is registered with the purpose it serves and how long it may be held. A query asking for a field that is not registered fails when the code loads, not in review. Card numbers, card ranges, expiry dates and your customer list are not in the register at all.

When a case is closed or found ineligible, the parts of the file that were only justified while the case was live are cleared, and a record that they existed is kept.

What enforces it: Short-lived sensitive fields are blanked on closure and the row is left as a tombstone carrying its type and a hash, so the audit trail survives without the content. The raw address and security-code letters returned by a payment gateway, and any free text a provider wrote about a person, are cleared on the same pass.

Merchants, partners and Revient staff sign in to separate applications with separate sessions. A session for one is never a session for another, and no control anywhere switches between them.

What enforces it: Each realm resolves its own session and each page asks for its own realm. There is no shared super-user session and no switch control in the product. Holding two memberships on one identity means signing in twice, in two places.

A partner is an organisation reviewed and approved for named capabilities in named jurisdictions. Pending, expired, suspended and unsupported all resolve to refused.

What enforces it: Capability and jurisdiction are checked as a grant, not as a status flag, and every state that is not an active approval returns a refusal. There is no pool of merchant data for an approved organisation to browse; a partner sees only what has been matched to it.

Approval to collect a debt is not approval to buy one. An organisation that does both holds each approval on its own merits, per market.

What enforces it: The two capabilities are separate grants against separate jurisdiction approvals. The purchaser of a receivable is always the approved organisation, never the individual signed in on its behalf.

The fee that applies to a case is the version in force when the work was accepted. A later change to a partner's commercial terms cannot reach back into it.

What enforces it: Commercial terms are versioned, and the accepted piece of work stores the version it was accepted under. Partners can view their terms and ask for a change; they cannot edit an active fee in their own settings.

A partner saying a payment arrived does not make it recovered money. The two are separate states and only verification moves a case from one to the other.

What enforces it: Reported payments and verified payments are different states in the case record, and the money you are shown as recovered is the verified figure. Amounts are held as whole minor units in their original currency and are never added across currencies.

Important actions record who performed them and from which portal. A support action taken by Revient staff is recorded as staff, never disguised as you.

What enforces it: Each audit row carries the actor, the type of actor and the portal the action came from. Reading sensitive raw content is itself recorded.

Payments and payouts run only through providers that have been configured, tested and explicitly switched on. A credential existing in an environment is not an activation.

What enforces it: A provider has to be saved, tested and activated by a person before it can be used, and turning the production money switch on without production credentials fails at startup rather than falling back to a simulation.

Revient uses AI to read and summarise documents. It is never where a fact comes from, and it never decides where a case goes.

What enforces it: Facts are read from the source that holds them and keep a link back to it. Whether a case is eligible follows written rules, not a model's judgement, and a case that cannot be stood behind is stopped before it goes anywhere.