| Tenant / workspace | One customer business's isolated space: its users, accounts, transactions, documents, settings. "Tenant" (engineering) and "workspace" (user-facing) are the same thing. See Tenant lifecycle. |
| Client user | A person who belongs to a tenant workspace and uses the product (the SPA/API). Contrast with operator. |
| Operator | Platform staff — support, compliance, admins — working across all tenants from the backoffice. A different login surface, a different permission catalog. |
| Rail / provider | An underlying regulated finance partner that actually holds funds, executes transfers, or runs KYB/KYC. Stables orchestrates; the provider executes. Conduit is the money rail; onboarding is multi-provider (Sumsub for GB/EU); custody is routed to Utila (live-in-code, pre-product). Which one serves a capability is decided by provider routing (below). See Providers & rails. |
| Mirror | Our local, queryable copy of an object the provider owns (a wallet, a transaction, an order). Synced by webhooks plus a reconciliation backstop. A mirror reflects provider truth — we never invent its state. |
| Projection | A derived read model rebuilt wholesale from provider data — e.g. account balances, overwritten from each provider snapshot, never incremented locally. A balance is a mirror of the rail's ledger, not a ledger we compute. |
| Master balance | A tenant's total holdings in one number: every asset's balance summed and converted into the base currency with exact decimal math. Carries rate freshness (rates_as_of) and a provisional-rates flag in V1; an asset that cannot be priced is reported unconverted, never guessed. See Money movement. |
| Base currency | The single currency the master balance converts everything into. V1 supports USD only — any other requested base is cleanly refused rather than partially answered. |
| Reconciliation | The scheduled backstop sweep that re-fetches stale mirrors from the provider, catching anything a missed webhook left behind. |
| Drift | A mirror disagreeing with the provider (usually a lost/late webhook) until reconciliation catches it. The product symptom: "our screen is briefly behind." |
| Maker/checker (dual control) | Two-person control on money movement: one user makes a request (e.g. a payout), a different user checks and approves it. Enforced in code, not policy. |
| Segregation of duties | The rule that the same person cannot hold both sides of a controlled action (payout maker ≠ approver; SAR drafter ≠ reviewer ≠ submitter). |
| Co-sign | The final, out-of-band signature on a payout, performed at a provider-hosted URL with the signer's own credentials — outside our system, so a compromise of Stables alone cannot move funds. |
| Step-up (fresh MFA) | A re-challenge of MFA immediately before a sensitive action, proving the actor is present now — a session from this morning is not enough. |
| RFI | Request for information — the platform asking a user for something before an item can proceed (e.g. sender information on a deposit from an unknown address). |
| Travel rule | The regulation requiring originator/beneficiary information to travel with certain transfers. Surfaces as deposit RFIs and compliance travel-rule records. |
| KYB / KYC | Know Your Business / Know Your Customer — the provider-run verification of the tenant business and its people during onboarding. |
| Enhanced due diligence (EDD) | Deeper scrutiny the provider can require on a KYB application. Surfaces as a flag on the mirrored application ("this business needs additional review"); the business can be asked for more and can submit again. See Tenant lifecycle. |
| Entitlement | What a tenant's plan tier grants for one feature: a switch, a quota, a limit, or a rate. See Plans & entitlements. |
| Quota / limit | A metered allowance per period (quota — e.g. orders per month) vs a cap on a single action or standing state (limit). |
| Jurisdiction gate | Availability by region: a jurisdiction decides whether a feature exists there at all; the tier then decides how much of it a tenant gets. |
| Provider routing | Which external provider serves a given capability for a tenant — decided per capability group × the tenant's jurisdiction (a provider must be licensed there), compliance-first, never a silent fallback to a default. Now live for onboarding (Sumsub for GB/EU, Conduit elsewhere); every other capability resolves to Conduit today. See Providers & rails. |
| Freeze vs suspension | A freeze is a compliance intervention on the tenant's account: login still works, every action is refused. A suspension is a workspace lifecycle state (suspended) that blocks the workspace itself. Different levers, different owners. See Compliance & trust. |
| Case | A compliance work item (sanctions hit, transaction alert, onboarding review…) with an owner, an SLA, and a recorded outcome (disposition). |
| Disposition | The terminal outcome an operator records on a case, always with a written rationale. |
| SAR / CTR | Suspicious Activity Report / Currency Transaction Report — regulatory filings. In V1 Stables prepares the evidence and records the handoff; the rail files with regulators. |
| Audit trail | The immutable, hash-chained record of every command attempt — including denied and failed ones. See Compliance & trust. |
| WORM | Write-once-read-many storage — the audit trail's daily export target: once written, records cannot be altered or deleted. |
| Crypto-shred | Deleting data by destroying its encryption key: the ciphertext remains but is permanently unreadable. How right-to-be-forgotten is honored for vaulted documents. |
| Envelope encryption | Each document encrypted with its own key, which is itself encrypted — the mechanism that makes per-document crypto-shred possible. |
| Idempotency key | A client-supplied key that makes a retried write safe: the same request submitted twice (a timeout, a double-click) executes once. |
| Async request (request-then-poll) | The pattern for slow work: the API accepts immediately (HTTP 202) and hands back a pollable request that later carries the result — typically a short-lived download link. See Async by design. |
| Task run | One tracked background run (e.g. the monthly-statement sweep) in the durable ledger operators can inspect — status, per-unit outcomes, retries. |
| Comms log | The durable record of every notification/email actually dispatched, per tenant. See Notifications & comms. |
| Vendor request log | The append-only central log of every outbound call to the finance rail, per attempt (bodies encrypted, sensitive fields redacted). Transport telemetry, not the compliance record — pruned on a 90-day window (app-modules/rails/config/rails.php). See Providers & rails. |
| DLP | Data-loss prevention: classification of sensitive fields plus logging/alerting on sensitive reads and data leaving the system. |
| Signed URL | A short-lived, tamper-proof link that is the only way document bytes are served; every use is logged. |