Feature catalogue
Everything the product does
This page lists what is built and shipping. Rates, tiers, minimums and labels shown anywhere below are defaults you edit — they are configuration, not behaviour of the product. Nothing on this page is a roadmap item; the things that are not built are listed at the bottom, by name.
The investor panel
A signed-in application with a fixed left navigation: Dashboard, Investment Plans, Payments & wallet, Partners, Leader's Co-Pilot, Account.
Accounts, sign-in and recovery
| Feature | What it does |
|---|---|
| Registration | Creates the account, opens a session immediately, and optionally links the new member to a referrer by referral code. |
| Email verification | A token is emailed and the account is flagged unverified until it is redeemed. Resend is available. |
| Password sign-in | Password login setting an HttpOnly session cookie. |
| Two-factor sign-in step | When the member has an authenticator app enrolled, sign-in completes only after a TOTP or recovery code. |
| Emailed one-time code | A fallback path that emails a six-digit sign-in code after the password is verified; the session exists only after the second leg. |
| Passwordless magic link | A one-time emailed link that signs a member in without a password. You can switch it off. |
| Google sign-in | Authorization-code flow with PKCE. Accounts are linked only by Google's immutable subject id — an unlinked Google account whose email happens to match a member is refused, not signed in. Off unless you enable it and supply your own client id and secret. |
| Forgot and reset password | Token-emailed reset. The forgot endpoint always returns success, so addresses cannot be enumerated through it. |
| Change password while signed in | Self-service, with a step-up verification code. |
| New-device confirmation | A sign-in from an unrecognised device needs an emailed confirmation code before the session is usable. The code can be re-issued. |
| Public handle | A member can claim a unique public username; a taken handle is refused and changes are counted. |
Dashboard and portfolio
| Feature | What it does |
|---|---|
| My accounts dashboard | The landing page: wallet cards, plan tiles, commission summaries, a network tree link, an identity-verification prompt, an earning-limit prompt and a transfer-to-main action. |
| Portfolio balance chip | The aggregate balance shown in the top bar of every signed-in page. |
| My investments | Individual approved investments plus per-wallet summaries, computed from one canonical ledger reducer rather than a per-page calculation. |
| Per-event earnings | Each distribution event's earnings for a single investment, so a member sees every accrual rather than only a total. |
| Tile order | You reorder or hide member dashboard tiles from the admin panel, without code. |
Plans and investing
| Feature | What it does |
|---|---|
| Plan catalogue page | One page per plan, driven by the live plan record — rate, cycle and minimum come from the record. |
| Shipped plan set | Four plans ship as a starting point: Growth, Balanced, Institutional and Prime Growth (invite-only per member). Names and economics are yours to change. |
| Invest from wallet balance | Move funds from the Main Wallet into a plan instantly. |
| Invest with crypto | Creates a payment at your payment provider and shows a pay-to address, amount, QR code and countdown. |
| Invest with a credit voucher | Redeem a voucher code you or a leader issued; creates an auto-approved investment. |
| Per-member minimum | An invite-only plan can carry a per-member minimum enforced on the server; the hidden menu entry is never trusted. |
| Profit split | An investor can route a percentage of their own investment's profit to another member, from now or from the start. |
| Per-investment cap and state | Each investment carries a payout cap and a lifecycle state — active, paused or closed — that the accrual engine honours. |
Deposits
| Method | What it does |
|---|---|
| System wallet | Transfers an existing Main Wallet balance into a plan. |
| Crypto through the gateway | Creates a payment at your NOWPayments account; the member sends the coin to the generated address. USD-pegged stablecoins are priced one-to-one so the invoice is a round number; other coins keep USD pricing at the live rate. The gateway fee is absorbed by you, not added to the depositor. |
| Credit voucher | Redeems a voucher code as an investment. |
| Direct deposit (manual) | The member sends USDT to your house address for the chosen chain and submits the amount and the on-chain transaction hash; you verify and approve. Hidden unless you grant that member the direct-deposit permission. |
| Status and cancel | A pending gateway deposit can be polled live and cancelled before payment. |
| Fee estimate | Quotes the crypto amount for a USD figure before the member commits. |
Networks and coins, stated precisely
- The manual USDT deposit accepts three chains: BNB Smart Chain (BEP-20), TRON (TRC-20) and Ethereum (ERC-20).
- The gateway deposit selector, as shipped, offers one option: USDT on BNB Smart Chain. The endpoint accepts any currency code your provider supports, so you can extend the list — but we will not advertise a number we did not ship.
- Per-chain address and transaction-hash formats are validated on both the client and the server, and the server re-resolves your house address per chain rather than trusting anything the browser sent.
- A load-time invariant refuses to start the application if a deposit chain has no matching payout rail, so funds cannot be taken on a chain they could never leave.
Withdrawals and transfers
| Feature | What it does |
|---|---|
| Crypto withdrawal | Two steps: request, then confirm with an emailed one-time code and the authenticator code when enrolled. The confirmation is bound to the exact amount, network and address — a code issued for one withdrawal cannot authorise another. |
| Withdrawal networks | Six selectable chains: BNB Smart Chain, TRON, Ethereum, Solana, Polygon and Bitcoin. USDT payout rails exist for five of them; a USDT withdrawal that selected Bitcoin is blocked at payout rather than paid on the wrong chain. |
| Minimum withdrawal | $15 as shipped. |
| Cancel a pending withdrawal | Cancels the code-sent-but-unconfirmed state. |
| Member-to-member transfer | Send balance to another member by email, user id or referral code, with the fee quoted first and the same two-factor confirmation as a withdrawal. The recipient is shown, masked, before submit. |
| Address book | Saved crypto addresses and trusted transfer recipients, added through two-step confirmation, and used to drive an anti-hijack hold on newly added addresses. |
| Wallet-to-wallet transfer | Instant movement between a member's own wallets. |
| Create a transfer voucher | Turns Main Wallet balance into a redeemable voucher code, with the funds deducted immediately; the creator can cancel an unredeemed one for a refund. |
| Transaction history | One entry per wallet movement across every wallet. Internal transfers appear as two rows, out and in, so both sides reconcile. |
Referral, team and partner views
| Feature | What it does |
|---|---|
| Partners area | Headline statistics for the signed-in member's network. |
| Network tree | The member's downline as a live tree, valued in real time from the canonical parent link. |
| Team list | Paginated downline list, filterable by level. |
| Commission history | Paginated commission rows, filterable by engine. |
| Working-plan detail | Three-level commissions grouped by level, each showing who invested and which investment produced it. |
| Leg volume | The top three legs ranked by qualifying investment volume for a weekly window. |
| Weekly network investments | The member's downline plan investments for one weekly pool window, read-only. |
| Partner transaction history | Commissions, earning-limit payments, vouchers, deposits and transfers involving the partner wallet. |
| Published commission rates | The rates you configured are exposed to the partner-facing pages, so members read your real numbers rather than hardcoded ones. |
| Increase earning limit | A member can pay to raise their own commission cap; the cap is a multiple of the fees they have paid. |
Leader's Co-Pilot
These screens appear only for the members you appoint as leaders or voucher delegates.
| Feature | What it does |
|---|---|
| Voucher request | A leader requests a credit voucher for a downline member; you approve or reject, with an auto-approve path under caps you configure. |
| Voucher preview validation | Validates the recipient's investment and shows the maximum voucher amount before the request is submitted. |
| Cashback claim | A leader claims cashback against a verified investment, with real-time validation of the investment id and an optional reference member. |
| Direct sell claim | A leader claims credit for a sale by proving knowledge of the investment id and amount. Volume only — it moves no money. |
| Direct deposit on behalf | A leader holding the direct-deposit grant submits a manual USDT deposit for a downline member. |
| Leader's wallet | The leader's own held-balance view. |
| Notes to the operator | A two-way note thread between a leader and you. |
Compliance the member sees
| Feature | What it does |
|---|---|
| Identity verification | Upload an identity document and a selfie. Images are stored privately and the case marked submitted first, then sent for verification, so nothing is lost if the provider is slow. |
| Verification status | Pending, submitted, verified or rejected, with timestamps. |
| Rejection notice | An unacknowledged rejection is surfaced to the member with the reason, and the acknowledgement is recorded. |
| Source-of-funds response | When you raise a source-of-funds round against an investment, the member answers it in-app — claimed transaction id or hash, and a description — against a deadline. |
| Nominee / next of kin | A member registers nominees with allocation percentages and an identity document, behind two-step two-factor confirmation, and can remove one the same way. |
| Nominee claim | A nominee files a claim against a deceased holder's account without having an account, uploading a death certificate and their own identity document. |
Communication and settings
| Feature | What it does |
|---|---|
| Inbox | A paginated in-app notification inbox with categories and filters. |
| Bell and unread badge | A cheap unread count polled by the top bar. |
| Mark read | Per notification and per category, including mark-all. |
| Notification preferences | A per-category, per-channel preference grid the member controls. |
| Announcement modal | Your current notice appears once per member at sign-in; the dismissal is durable and per member. |
| Email unsubscribe | One-click unsubscribe from a token in the email, plus an in-app toggle. |
| Personal information | Name, phone and address. |
| Authenticator app | Enrol with a QR code, confirm the first code, and disable only with the password and a valid code. Secrets are stored encrypted. |
| Recovery codes | One-time recovery codes, regenerable, stored hashed. |
| Device history and sessions | The member's known devices with a live-session overlay, and the ability to revoke them. |
Public pages
| Page | What it is |
|---|---|
| Home | Your site's public marketing home page. |
| Terms and Privacy | Shipped policy pages you replace with your own through Site Control. |
| Performance banner | A shareable public banner. Growth is reported as the sum of actual distribution-run payout rates — a record of what was paid, never a projection. |
| Branding endpoint | Public and pre-login: name, logo, favicon, colours and mode, with neutral defaults so the site renders before anything is configured. |
| Terminology endpoint | Public: your chosen word for each renameable concept, so signed-out navigation reads in your vocabulary too. |
The operator panel
54 admin pages behind a session gate with role-based access. The navigation groups are Overview, Users, Money, Commissions, Plans, Vouchers, Communication, Leader Copilot and System.
Overview and reporting
| Screen | What it does |
|---|---|
| Admin dashboard | Totals for members, active in 30 days, new today and new this week, plus money tiles. Tile order and visibility are configurable. |
| Analytics | Proxies a Plausible statistics query for your site, with the API key kept server-side. Requires your own Plausible key and site id. |
| Growth report | Two series bucketed by day, week, month, quarter, half-year or year. |
| Financial summary | One read-only money report over any date range. |
| Distribution overview | Rolls the four money-flow lenses onto one page. |
| Audit dashboard | A read-only view rolling every distribution family and completed run over a range. |
| Pending counters | Per-navigation-item counts of items awaiting your action, rolled up onto collapsed section headers. |
Member management
| Screen | What it does |
|---|---|
| Members list | Paginated with advanced filters. You can also create a member directly. |
| Network tree for any member | The referral tree for anyone, to a depth you choose. |
| Per-member earnings | Main wallet, per-plan flows, commissions and withdrawals in one breakdown. |
| Per-member cashflow | Bucketed cashflow analytics over 30 days, 90 days, a year, or all time. |
| Per-member wallet history | Drill-down into one member's full activity feed. |
| Earning-limit multiplier | Read and set the per-member and global multiplier. |
| Withdrawal lock | Lock a member's withdrawals indefinitely, for a set number of hours, or unlock. |
| Team-transfer block | Toggle a member's free in-network transfer perk. |
| Private notes and row flags | Per-entity private notes and a persistent per-row checkbox on admin lists. |
| View as member | Creates a real member session for a target member so every page loads exactly as they see it, while your admin session stays intact so you can return. Superadmin only, and written to the audit log. |
Compliance review
| Screen | What it does |
|---|---|
| Identity review | A review queue with document viewing; images are streamed from private storage to authenticated admins only. |
| Source of funds | The register of every verification round with its investor, status and deadline. You raise, review and close rounds. |
| Nominee claims | A review queue for claims, with document streaming. |
Money operations
| Screen | What it does |
|---|---|
| Transactions | A paginated, filterable list of every transaction, admin creation, and the settle state machine that approves or rejects deposits and withdrawals. |
| Investments | Sortable and filterable, with a per-investment detail view showing the net breakdown and every beneficiary of that investment. |
| Balances | Platform-wide wallet balance totals across all members. |
| Mass payout | Lists pending crypto withdrawals eligible for payout, creates a provider payout batch, submits the emailed provider verification code and syncs batch status. Each row is paid on its own chain's USDT rail, and a batch containing a row with no rail is refused rather than paid on the wrong chain. |
| Deposit address pool | Your house deposit addresses per chain, with one default per network enforced by the database. |
| Transfer fee registers | Collected member-transfer and partner-to-main transfer fees, searchable by date. |
| Milestone bond queue | A review queue for annual milestone claims — status only, no money. |
| Gift wallet | The company gift-wallet history and running balance, where commission overflow above a member's earning limit lands. |
| Distribute wallet | Per-plan treasury buckets with a deposit and withdraw ledger, used to fund distributions. |
Distribution and commissions
| Screen | What it does |
|---|---|
| Profit distribution | Two phases: preview computes every credit, execute hands it to a durable workflow that applies it idempotently. A retried run cannot double-pay. |
| Single-investment credit | Credit earnings to one investment, or run one commission type on its own. |
| Distribution history | Every investment that received a distribution. |
| Commissions register | Paginated rows joined to recipient and source member, filterable by type, level, status and free-text search. |
| Residual settings | The eligibility policy: minimum depth, minimum invested amount, per-member overrides, promotional grants and waivers. |
| Residual preview | Runs the same engine the real distribution runs, read-only, so you see the outcome before paying it. |
| Residual distribution | Executes and tracks residual runs, per run and per member. |
| Residual tree and eligibility | One member's downline across levels 1 to 25 with per-row eligibility, plus the list of everyone currently eligible. |
| Residual history | Every residual credit, one row per credited recipient event. |
| Weekly performance pool | Runs the weekly pool engine and shows its qualifying data. |
| Monthly incentive | Runs the monthly incentive tier ladder and shows its qualifying data. |
| Per-plan commission overrides | Override the working-plan and residual ladders per plan and per level. Overrides apply to the next settlement onward; already-settled commissions are immutable. |
| Partner levels | The level and rank configuration screen. |
Plans and vouchers
| Screen | What it does |
|---|---|
| Plan Builder | Full control over the catalogue: name, media, minimum and maximum, a fixed rate or a band, the accrual period (hourly, daily, weekly, monthly, yearly or end of term), term, compounding, capital-return mode (at end, with profits, or none), payout cap, early cancel, working-days-only accrual, rollover, visibility and currency. Superadmin only. |
| Legacy plan settings | The older per-plan returns, cycle and minimum editor still ships alongside the Builder. |
| Plan statistics | Per plan: investor count, total invested, total earned, remaining. |
| Invite-only plan | Its own settings screen and its own investor-only distribution action. |
| Vouchers | Create, list, filter and search credit vouchers. |
| Voucher requests | The delegate-submitted queue, with approve and reject reasons. |
| Voucher accounting | Read-only aggregates over vouchers and earning limits. |
| Voucher usage | Per-member redemption aggregates. |
| Earning-limit reset | A guarded one-time reset that zeroes only the voucher-derived portion of earning limits, with a dry-run mode first. |
| Leader flags | Flag a voucher request low, mid or high with a description. |
Communication and the leader programme
| Screen | What it does |
|---|---|
| Support tickets | List, filter and search tickets; update status and add admin notes. Tickets are raised automatically when a payment needs attention — for example a deposit that arrived partially paid opens one rather than crediting silently. |
| Announcements | Post a notice to all members and see per-notice dismissal counts. |
| Subscribers | The newsletter list, newest first, with CSV export. Deliberately minimal: address, when, and where from. |
| Leader Copilot dashboard | Every voucher delegate with their request and flag statistics. |
| Appoint a delegate | Set a member's leader role: copilot, super pilot, master pilot, regional director, or none. |
| Block a leader | Toggle a leader's voucher-request gate. |
| Leader notes | Your side of the two-way note thread. |
| Cashback queue | Leader cashback claims, newest pending first, with a per-leader earnings leaderboard. |
| Direct-sell queue | Leader direct-sell claims with the verification detail surfaced. |
Site control and system
| Screen | What it does |
|---|---|
| Branding | Brand name, legal name, tagline, logo URL, favicon URL, support email, theme mode and colours. Neutral defaults mean the site renders before you set anything. |
| Site settings | A typed registry: SEO title, description, keywords, social image and handle; maintenance mode with its own heading and message; custom CSS; a cookie-consent banner; robots.txt; sitemap.xml; interface density; animation preference; dashboard tile order; terminology; and social sign-in. |
| Terminology rename | Rename Partner, Referral, Downline, Upline, Commission, Network, Level, Investment and Member — and their plurals — across the whole interface, word by word. Never a global find-and-replace, so routes and column names are untouched. |
| Manage Pages | Create, edit, publish and unpublish whole pages of your own: slug, title, body, meta title, meta description, draft or published. |
| Manage Frontend | Edit named content fragments inside pages that already ship, keyed by a marker in the markup — so the shipped copy is the default and your saved row is the override. |
| Content revisions | Every page and fragment edit stores its before and after body, separately from the money audit trail. |
| System settings | A typed toggle registry over commission rates, residual levels, session policy, captcha toggles, payment-provider pointers and the accrual holiday list, each with its own validator. |
| Modules | The installed-module registry plus the built-in catalogue; enable and disable at runtime. Module-contributed settings screens and admin menu entries render without a core change. |
| Audit log | A paginated admin audit trail: who, what action, which entity, details, IP address and time. Superadmin only. |
| Sessions | List and revoke the active sessions of any member or admin. |
| Global sign-out | A kill switch that invalidates every member session, or every admin session. |
| Session policy | Idle timeout, absolute maximum, remember-me duration, impersonation window, admin idle and absolute limits, and the last-seen bump interval — all editable within enforced ranges. |
Automation engines
The hourly cycle
One scheduled entry point runs the whole automated cycle on your site. It is machine-triggered, authenticated by an internal secret that fails closed, and each pass does the following in order.
- Source-of-funds sweep, fail closed. Lapsed proof deadlines are applied before any accrual. If the sweep errors, the cycle aborts and nothing accrues.
- Due-plan selection. Only enabled plans with an unambiguous per-period percentage rate accrue automatically. Rate-band and absolute-rate plans stay operator-driven and are reported as skipped, with a reason. Cadence is enforced once per period, counting any completed run — including one you ran by hand.
- Accrual. Each due plan is driven through the same durable preview-then-execute path you use, with a deterministic run id, so a retried cycle is a no-op.
- Housekeeping, fail isolated. Expired earning-limit vouchers are reconciled; a failure here is reported and never aborts the cycle.
- Weekly pool and monthly incentive, each gated on a real period rollover so a heavy distribution fires at most once per period.
- Maturity sweep. Investments past their term stop accruing and, depending on the plan's capital-return mode, either return principal as a portfolio-neutral two-leg entry or latch a zero-money completion marker. A with-profits investment owed a final catch-up gets exactly one, computed against a latched target so a later plan edit cannot retroactively change a settled investment. If the principal cannot be released honestly, it fails closed and flags for review rather than fabricating the difference.
- Commission replay. Events parked because the accounting schema was not ready are drained.
- Residual reconciliation. Torn events are re-paid and stalled runs re-kicked by reading the immutable settlement footprint only — never live referral, rate or capacity data.
Working-days accrual is supported: a plan can skip weekends plus a holiday list you maintain.
One accrual primitive
A single pure module computes every investment's capped return and profit-split carve, and the four engines that used to each re-implement it now call it. It honours the per-investment cap, the plan cap, the investment's control state, compounding and the investor fraction.
The four commission engines
| Engine | What it pays on |
|---|---|
| Working Plan | Three-level commissions on a downline member's investment. Shipped defaults are 5%, 2% and 1%, each level editable and unlockable by qualifying direct referrals. |
| Residual | Twenty-five-level profit-based distribution, gated by direct-referral count per level. The shipped default ladder runs 15% at level 1 down to 1% at levels 16 to 25. |
| Monthly Incentive | Team-volume tiers, each availed once, paid as equal monthly installments. |
| Weekly Performance Pool | Three-network qualification with a 40/35/25 split, recurring, paid on the second and third networks in weekly installments. |
The network structure is unilevel. Binary and matrix compensation structures are not built.
Settlement, idempotency and reconciliation
- Distribution is two-phase: a preview computes every leg, and execute hands it to a durable workflow that applies it with deterministic ids and status-guarded writes.
- Residual settlement writes an immutable footprint — an event row, one leg row per payment, and a capacity snapshot — and a leg's amount is protected by a database trigger that refuses any change.
- An event counts as settled only when every leg it declared has durable evidence. "Some evidence exists" is explicitly not treated as proof.
- Treasury debits derived from a settled run are exactly-once, keyed on the sealed footprint. A failed debit becomes a durable, reconciliation-visible obligation with its own retry states — not a log line.
- Commission events that arrive before the accounting schema can guarantee at-most-once are parked, not paid, and replayed later.
- Referral chains are sanitised for self-reference, cycles and duplicate uplines before any payout. Damaged data routes to the company, never to a wrong recipient.
Deposit confirmation and modules
Provider webhooks are signature-verified, then normalised into a provider-neutral event; the provider-agnostic core owns every balance change, plan activation, bonus and hook fan-out. A partial payment automatically opens a support ticket rather than crediting silently.
The module engine is a registry table plus a hook and event bus. Built-in modules self-register, the bus filters to the enabled set at emit time, and every handler is fail-safe, so one module's error cannot break a core action or another module. Five modules ship built in, and the referral commission module is seeded enabled on a fresh install so a new site can never take a deposit whose commission is silently blocked. Declared hook events include user registration, sign-in, deposit creation and confirmation, withdrawal request and payment, plan purchase, accrual, identity status and outbound email — plus collection hooks for the admin menu, the member menu and settings screens.
Integrations
Every integration below runs on your account with the provider, using credentials held as environment secrets on your deployment. Money from your members flows to your provider account, not through us.
| Integration | What is wired | Whose account |
|---|---|---|
| NOWPayments — deposits | Create a payment, poll its status, estimate a fee, and receive a signature-verified webhook. The signature is an HMAC-SHA512 over the recursively key-sorted body, compared in constant time. | Yours |
| NOWPayments — payouts | Create a payout batch, submit the emailed two-factor token, poll a payout or a batch, and receive a separately verified payout webhook. Deliberately a distinct adapter with its own credential. | Yours |
| Payout chains | USDT rails for Ethereum, BNB Smart Chain, TRON, Solana and Polygon. Bitcoin is deliberately absent — there is no USDT rail for it, so it is blocked rather than mis-paid. | — |
| Didit — identity verification | An identity-verification call to the Didit Standalone API. Documents are saved to private storage and the member marked submitted before the call, so nothing is lost on a provider timeout. A provider rejection leaves the case for manual review rather than auto-failing the member. Without the key, the product falls back to manual admin review — it does not break. | Yours |
| Cloudflare Turnstile — captcha | Per-page toggles for sign-in, sign-up, forgot-password and admin sign-in. Off by default on every page. Once a page is switched on and no secret is configured, it fails closed. | Yours |
| Cloudflare Email Sending | The shipped email transport, behind a provider seam, always including a plain-text part. The sending domain must be onboarded with SPF and DKIM before delivery works. | Provided with the deployment |
| Google sign-in | Authorization-code flow with PKCE, linked by subject id only. Off by default. | Yours |
| Plausible — analytics | An admin-only proxy over the Plausible statistics API; the key never reaches the browser, and an unset key returns a clear "not configured" error. | Yours |
Read this before you buy
Your site cannot take a member deposit until you have a NOWPayments merchant account and its credentials are set on your deployment. Until then the deposit endpoint answers "payment system not configured". The same is true of automated identity verification, captcha, analytics and Google sign-in: each needs your own account with that provider.
Those credentials are environment secrets on your deployment, and there is no self-service screen in the customer panel for entering them today. We are not going to describe a screen that does not exist — ask us before you buy if this matters to your timeline.
Security and operations
| Control | What it is |
|---|---|
| Admin roles | Two enforced ranks: admin and superadmin. Superadmin outranks admin, and an unknown or blank role is denied everything. |
| Superadmin-only actions | Global settings, mass payout, the distribution engine, the treasury buckets, session listing and the global kill switch, view-as-member, the audit log, module enable and disable, Plan Builder, per-plan commissions, and everything under Site Control. |
| Admin sign-in | Password, then a six-digit one-time code emailed before the session is created. |
| Session model | Sessions live in a key-value store with a per-session reverse index key, so concurrent sign-ins never race and each entry expires on its own. Policy is edited in the database and mirrored into one cheap blob the hot path reads. |
| Session policy ranges | Member idle 1 to 1440 minutes (default 30), member absolute 1 to 720 hours (default 24), remember-me 7 to 30 days (default 30), impersonation 1 to 240 minutes (default 30), admin idle default 120 minutes, admin absolute default 168 hours. |
| Two-factor | TOTP with encrypted secrets and hashed one-time recovery codes. Disabling requires the password and a code. |
| Withdrawal two-factor | An emailed code always, plus the authenticator code when enrolled. The code is cryptographically bound to the amount, network and address. |
| Optional: require 2FA to withdraw | A member without an authenticator app cannot withdraw. Off by default. |
| Optional: new-account withdrawal hold | Withdrawals refused for a number of hours after account creation. Zero disables it. Per-member locks still apply on top. |
| Identity gate on money out | Withdrawal, voucher withdrawal and member-to-member transfer each require a verified identity explicitly — fail closed, not merely "not rejected". Moving funds between a member's own wallets is deliberately not gated, because nothing leaves the platform. |
| Admin IP allow-list | One address or CIDR range per line, IPv4 or IPv6, restricting the admin API only. Members are never affected. A wholly unparseable list is treated as blank so a typo cannot lock you out, and enforcement is a separate switch. |
| Rate limiting | A shared limiter with two independent budgets — per IP address and per account — so an attacker who knows only an address cannot lock a member out, and one abusive address cannot hide behind many accounts. Applied to sign-in, one-time code, passwordless and admin sign-in. |
| Wallet concurrency | A withdrawal spend takes a wallet lock, and the treasury debit is an atomic exactly-once operation rather than a read-then-write. |
| Audit trail | Every audited admin action records the admin id and email, the action, the entity type and id, details, IP address and time. Writes are fail-safe so an audit outage never blocks the action. Viewable superadmin-only. |
| Maintenance mode | Takes the public site to a notice with a heading and message you write. Admins and the admin panel are never locked out. |
| Cookie consent | An optional consent banner with your own text, button label and policy link. |
| Crawler control | Your own robots.txt and sitemap.xml. Left blank, the product generates a safe default and a sitemap from your published pages. |
| Settings safety | Only keys declared in the registry can be written, and each is coerced to its declared type. A settings endpoint that accepted arbitrary keys against a shared table would be a privilege-escalation primitive. |
| Security screen honesty | The security settings group deliberately lists only controls that are actually enforced. |
What is not included
This list is here on purpose. A buyer should find out what is missing before paying, not after.
- No self-service backup or restore. There is no backup or restore button in the admin panel, and no export tool beyond the newsletter subscriber CSV.
- Members cannot open a support ticket. The ticket system is real, but it is operator-side plus automatic — tickets are created when a payment needs attention. There is no member-facing "contact support" form.
- No bulk email campaigns. In-app notifications, the inbox, the bell and announcements all work. Broadcast campaign sending needs a second worker that is not deployed with your site.
- No editable email templates. Templates are stored but not wired into sending, and there is no screen for editing them.
- No bank transfer method. Treat the product as crypto-only. Bank-transfer code exists but no method card is shown to members.
- No granular permission matrix. Two ranks are enforced, admin and superadmin. There is no custom-role builder and no staff-user management screen.
- No third-party module marketplace. Modules are the built-in set you switch on and off. Uploading a module archive and having it run is not a path that exists.
- No SMS notifications, no mobile app, no blog or news content type, no rank badge or leaderboard feature, no lock-period staking plan, and no binary or matrix compensation structure.
- Custom domain activation is manual. You request it and get CNAME instructions; the final activation is a step we perform.
Things we will never claim
You will not find an uptime percentage, a service-level guarantee, a customer count, a testimonial, an award, or a compliance certification anywhere on this site. We have no way to substantiate any of them, so they are not here. The product includes identity verification, source-of-funds tooling and an audit trail; none of that makes you or us compliant with anything, and we will not pretend otherwise.