Glossary

What this covers / who it's for. Two references in one page: the domain vocabulary the rest of the wiki uses, and the status glossary — every user-visible lifecycle status, with the exact value the API emits and what it means to the person seeing it. All values are verified against the code's enums; when a doc and this page disagree with the code, the code wins.

Domain terms

Term	Meaning
Tenant / workspace	One customer business's isolated space: its users, accounts, transactions, documents, settings. "Tenant" (engineering) and "workspace" (user-facing) are the same thing. See Tenant lifecycle.
Client user	A person who belongs to a tenant workspace and uses the product (the SPA/API). Contrast with operator.
Operator	Platform staff — support, compliance, admins — working across all tenants from the backoffice. A different login surface, a different permission catalog.
Rail / provider	The underlying regulated finance partner (Conduit in V1) that actually holds funds, executes transfers, and runs KYB/KYC. Stables orchestrates; the rail executes. See Providers & rails.
Mirror	Our local, queryable copy of an object the provider owns (a wallet, a transaction, an order). Synced by webhooks plus a reconciliation backstop. A mirror reflects provider truth — we never invent its state.
Projection	A derived read model rebuilt wholesale from provider data — e.g. account balances, overwritten from each provider snapshot, never incremented locally. A balance is a mirror of the rail's ledger, not a ledger we compute.
Master balance	A tenant's total holdings in one number: every asset's balance summed and converted into the base currency with exact decimal math. Carries rate freshness (rates_as_of) and a provisional-rates flag in V1; an asset that cannot be priced is reported unconverted, never guessed. See Money movement.
Base currency	The single currency the master balance converts everything into. V1 supports USD only — any other requested base is cleanly refused rather than partially answered.
Reconciliation	The scheduled backstop sweep that re-fetches stale mirrors from the provider, catching anything a missed webhook left behind.
Drift	A mirror disagreeing with the provider (usually a lost/late webhook) until reconciliation catches it. The product symptom: "our screen is briefly behind."
Maker/checker (dual control)	Two-person control on money movement: one user makes a request (e.g. a payout), a different user checks and approves it. Enforced in code, not policy.
Segregation of duties	The rule that the same person cannot hold both sides of a controlled action (payout maker ≠ approver; SAR drafter ≠ reviewer ≠ submitter).
Co-sign	The final, out-of-band signature on a payout, performed at a provider-hosted URL with the signer's own credentials — outside our system, so a compromise of Stables alone cannot move funds.
Step-up (fresh MFA)	A re-challenge of MFA immediately before a sensitive action, proving the actor is present now — a session from this morning is not enough.
RFI	Request for information — the platform asking a user for something before an item can proceed (e.g. sender information on a deposit from an unknown address).
Travel rule	The regulation requiring originator/beneficiary information to travel with certain transfers. Surfaces as deposit RFIs and compliance travel-rule records.
KYB / KYC	Know Your Business / Know Your Customer — the provider-run verification of the tenant business and its people during onboarding.
Enhanced due diligence (EDD)	Deeper scrutiny the provider can require on a KYB application. Surfaces as a flag on the mirrored application ("this business needs additional review"); the business can be asked for more and can submit again. See Tenant lifecycle.
Entitlement	What a tenant's plan tier grants for one feature: a switch, a quota, a limit, or a rate. See Plans & entitlements.
Quota / limit	A metered allowance per period (quota — e.g. orders per month) vs a cap on a single action or standing state (limit).
Jurisdiction gate	Availability by region: a jurisdiction decides whether a feature exists there at all; the tier then decides how much of it a tenant gets.
Freeze vs suspension	A freeze is a compliance intervention on the tenant's account: login still works, every action is refused. A suspension is a workspace lifecycle state (suspended) that blocks the workspace itself. Different levers, different owners. See Compliance & trust.
Case	A compliance work item (sanctions hit, transaction alert, onboarding review…) with an owner, an SLA, and a recorded outcome (disposition).
Disposition	The terminal outcome an operator records on a case, always with a written rationale.
SAR / CTR	Suspicious Activity Report / Currency Transaction Report — regulatory filings. In V1 Stables prepares the evidence and records the handoff; the rail files with regulators.
Audit trail	The immutable, hash-chained record of every command attempt — including denied and failed ones. See Compliance & trust.
WORM	Write-once-read-many storage — the audit trail's daily export target: once written, records cannot be altered or deleted.
Crypto-shred	Deleting data by destroying its encryption key: the ciphertext remains but is permanently unreadable. How right-to-be-forgotten is honored for vaulted documents.
Envelope encryption	Each document encrypted with its own key, which is itself encrypted — the mechanism that makes per-document crypto-shred possible.
Idempotency key	A client-supplied key that makes a retried write safe: the same request submitted twice (a timeout, a double-click) executes once.
Async request (request-then-poll)	The pattern for slow work: the API accepts immediately (HTTP 202) and hands back a pollable request that later carries the result — typically a short-lived download link. See Async by design.
Task run	One tracked background run (e.g. the monthly-statement sweep) in the durable ledger operators can inspect — status, per-unit outcomes, retries.
Comms log	The durable record of every notification/email actually dispatched, per tenant. See Notifications & comms.
Vendor request log	The append-only central log of every outbound call to the finance rail, per attempt (bodies encrypted, sensitive fields redacted). Transport telemetry, not the compliance record — pruned on a 90-day window (app-modules/rails/config/rails.php). See Providers & rails.
DLP	Data-loss prevention: classification of sensitive fields plus logging/alerting on sensitive reads and data leaving the system.
Signed URL	A short-lived, tamper-proof link that is the only way document bytes are served; every use is logged.

Status glossary

Statuses come in two provenances: domain statuses (Stables owns the lifecycle) and mirrored provider statuses (the rail owns the lifecycle; we display it verbatim). Marked per table.

Workspace (tenant) — domain

Value	Meaning to the user
pending_verification	Registered; email not yet verified.
mfa_required	Verified; must enrol MFA before proceeding.
onboarding	In KYB/KYC with the provider.
active	Fully open for business.
suspended	Blocked by the platform; not terminal.
deactivated	Shut down; a step before offboarding.
offboarded	Terminal — the workspace has left the platform.

User account (both client users and operators) — domain

Value	Meaning
active	The only status that can log in.
suspended	Temporarily barred from authenticating.
deactivated	Removed from service (e.g. staff departure).

KYB application — mirrored (provider-neutral)

Value	Meaning
pending	Application created, not yet in review.
processing	Under review by the provider.
approved	Business verified — onboarding can complete.
rejected	Verification failed.
cancelled	Withdrawn/abandoned.

KYC verification (a person) — mirrored (provider-neutral)

Value	Meaning
pending	Verification initiated; outcome arrives via the provider.
completed	Person verified.
failed	Verification failed.

Payout — internal approval (domain) + provider status (mirrored)

Two parallel statuses: the approval status is our maker/checker state; the provider status is the rail executing it.

Approval value	Meaning
pending_approval	Created by the maker; waiting for a different user to approve. No money has moved; the provider has not been called.
submitting	An approver has claimed it and the provider call is in flight (reverts to pending_approval if the provider rejects).
approved	Released to the rail.
rejected	The approver refused it (with rationale).
cancelled	Withdrawn before approval.

Provider value	Meaning
pending / processing	The rail is executing.
awaiting_user_signature	Waiting for the out-of-band co-sign at the provider's verification URL.
completed	Funds moved. Terminal.
failed	The rail could not execute. Terminal.
cancelled	Cancelled at the rail. Terminal.

Order (on/off-ramp conversion) — mirrored

Value	Meaning
pending	Conversion accepted, executing.
succeeded	Conversion complete. Terminal.
failed	Conversion failed. Terminal.
cancelled	Cancelled before completion. Terminal.

Transaction (deposits and other money events) — mirrored

Value	Meaning
pending / processing	In flight on the rail.
awaiting_sender_information	A deposit parked pending travel-rule sender info — the RFI window is open.
completed	Settled. Terminal.
failed	Did not settle (a failure code + reason are shown). A sender-info timeout is a failed deposit carrying the failure code SENDER_INFO_TIMEOUT plus when/why-held detail; compliance takes over as a side effect. Terminal.
cancelled	Cancelled (with reason). Terminal.

"Held" disambiguation. A deposit whose travel-rule window times out is a failed transaction annotated with hold detail (SENDER_INFO_TIMEOUT, when and why it was held) — "held" is a description on that failed deposit, never a transaction status. It is distinct from a compliance held item (held → released, under Regulatory filings), which is an incoming item parked during an account freeze and released when the freeze lifts.

Async request (exports, statements, computed answers) — domain

Value	Meaning
queued	Accepted (the 202); waiting to run.
processing	Running.
succeeded	Done — the result (usually a short-lived download link) is attached. Terminal.
failed	Did not produce a result; safe to request again. Terminal.

Document (vault) — domain

Value	Meaning
awaiting_upload	A direct-upload slot exists; bytes not yet received.
stored	Our encrypted copy exists — before anything is forwarded to the provider.
forwarded	The provider has received its copy.
forward_failed	Every forward retry exhausted; on the operator triage register. Terminal.
shredded	Crypto-shredded (right to be forgotten); an unreadable tombstone remains. Terminal.

Scan value (orthogonal)	Meaning
pending	In malware-scan quarantine — not downloadable or forwardable yet.
clean	Scanned clean (or scanning disabled) — the only state a document is served from.
rejected	Flagged by the scanner; retained for forensics, never served. Terminal.

Compliance case — domain

Value	Meaning
open	Awaiting triage.
in_review	An officer is working it.
escalated	Raised (manually or by SLA breach).
closed	Resolved with a recorded disposition. Terminal.

Dispositions recorded at close: cleared, false_positive, confirmed_true_match, escalated_to_sar, no_action_required — each with a mandatory written rationale.

Regulatory filings — domain

Family	Values	Meaning
SAR	draft → in_review → submitted	The three-officer maker/checker ladder (details).
CTR	candidate → recorded	Auto-surfaced above the threshold; recorded documents the filing handoff.
Travel rule	pending_originator_info → recorded	Opens missing counterparty info; recorded once detail is attached.
Held item	held → released	An incoming item parked during a freeze, released when the freeze lifts.

Account state (compliance intervention) — domain

Value	Meaning
active	No intervention in force (a cleared/historical marker).
frozen	Freeze in force: login works, every action is refused.
closed	Account closed: terminal, no login.

Task run (background work) — domain, operator-facing

Run value	Meaning
running	In progress.
completed	Every unit completed or was skipped. Terminal.
completed_with_failures	Mixed outcome — some units failed. Terminal; retryable.
failed	Every executed unit failed. Terminal; retryable.
cancelled	An operator cancelled the run. Terminal.

Unit value	Meaning
pending	Queued (or reset by a retry).
running	An attempt is executing.
completed	Succeeded. Terminal.
failed	Failed for this run. Terminal.
skipped	Nothing to do, or the run was cancelled first. Terminal.

---

← Product wiki index