The ledger
A double-entry ledger where balances are derived from postings rather than stored, corrections are opposing entries rather than edits, and invariants are enforced at write time instead of checked by a nightly job.
Finance teams, auditors, regulators, and any business whose books have to survive a question.
Part of the platform itself: it is present wherever BitriPay runs.
The problem
Many systems keep a balance as a number and update it. The moment a balance can be set rather than posted to, the books stop being evidence and become an opinion that somebody with database access can revise.
How it works
- Every money movement is a transaction made of entries.
- The entries of a transaction sum to zero per currency; one that would not balance is refused, not written.
- A balance is the sum of its wallet’s entries — derived, never stored and edited.
- A correction is a new opposing transaction, so both the mistake and the fix remain visible.
What you can check
Facts about the running platform rather than adjectives. Each one is visible in the product, the API reference or the ledger.
- Postings are balanced per currency at write time; an unbalanced transaction is refused rather than written and fixed later.
- Reconciliation recomputes every wallet balance from its entries and reports any mismatch, rather than trusting the stored figure.
- Reversals are opposing postings; nothing is deleted, so the history of what happened stays readable.
- Guardian invariants watch for states that should be impossible — such as a payment captured without a posting — and can halt the platform rather than continue past them.
- Every state change is written to a hash-chained event log, so the record can be shown not to have been rewritten afterwards.
What it costs
Included. It is not a feature so much as the floor everything else stands on.
Questions
Can an administrator change my balance?
They can post to it, with an authority recorded and — for issuance — a second administrator approving. They cannot set it to a number, because a balance is not stored as a number: it is the sum of its own postings.
What happens when something goes genuinely wrong?
A correcting transaction is posted in the opposite direction. The original stays. Anyone reading the history later sees the mistake and the correction, which is what makes the books evidence rather than a story.
What is a Guardian halt?
An invariant watches for states that should be impossible. If one appears, the platform can stop rather than keep processing on top of a contradiction. Stopping is expensive; continuing on broken books is far more expensive.
Read next
Wallets and transfers
A transfer between two accounts is one balanced posting on a double-entry ledger, not a message between two systems that might later disagree.
Settlement and statements
A settlement statement that is numbered, hashed and reproducible, showing the provider fee, the platform fee and the tax on it as separate lines rather than one net figure.
E-money and safeguarding
An issuance rule the platform refuses on rather than reports on: e-money cannot be issued beyond cleared safeguarded funds, checked at the moment of issuance rather than at the end of the month.