Skip to main content

What Pehmen does

In one sentence

Pehmen makes every movement of money on your platform pass through a recorded decision, and makes the destination of seller money hard to change quietly.

Written for anyone deciding whether to adopt it.

The problem it is built for​

Platforms that onboard sellers and pay them out carry a risk their payment provider does not carry for them. The provider moves the money correctly. The question is whether it should have moved at all, and to whom.

The failures are ordinary and expensive:

  • An organizer's account is taken over, the bank account on file is changed, and the next payout goes to the attacker.
  • A new seller is onboarded with a plausible story, sells tickets for an event that never happens, and is paid before anyone notices.
  • An event cancels, refunds flood in, and the platform has already released the money to the organizer.
  • A finance team discovers, weeks later, that a payout record and the provider's settlement report do not agree, and nobody owns the difference.

Today most platforms handle this with people, spreadsheets and habit. Pehmen turns the habit into a workflow the software enforces, and turns the spreadsheet into records the software wrote at the time.

What changes on day one​

  • SellersEvery seller you pay has a registry entry with a verification level. Only an operator attestation can raise it. Your own submissions are recorded as pending, never as a verdict.
  • DestinationsEvery payout destination is registered once, with a masked account, a fingerprint, and what the provider said about the account holder's name. The account number itself is never stored.
  • ChangesChanging where a seller is paid waits out a cooling-off window (24 hours by default, 72 when the rules hold it), notifies both the old and the new verified contact, and needs a second person's approval. Whoever asked cannot be the one who approves.
  • PaymentsEvery payment gets a decision before it is routed, and the routing choice is stored with every candidate the engine considered, the checks each passed or failed, and the arithmetic that picked the winner.
  • PayoutsA payout is an instruction to a licensed provider. Approving it and releasing it are separate acts by separate people with separate permissions. Release is the only step that moves money.
  • IncidentsWhen something goes wrong there is a case: hashed evidence, a ledger of every action and what it replaced, and an appeal link a seller can use without an account.

The four modules​

Envelope is the trust registry: sellers, their verification, their payout destinations, and the change workflow. It also signs a Verified Commerce Envelope for an order, a record of the protection terms (what must be fulfilled, when money releases, the refund policy, the dispute channel) with a key the application itself cannot reach.

Gate is the decision engine. Every payment, payout, beneficiary change and seller status passes through it and gets one of six words: ALLOW, STEP_UP, HOLD, REROUTE, REVIEW, DENY. Every decision carries reason codes from a fixed registry of sixty, a score, and the exact version of the rules that produced it. The rules are yours: versioned policies that go live only after static checks, a replay against your own history, a second person's approval, and a fresh two-factor code. Any decision can be replayed later against the same rules and give the same answer.

Payout execution talks to the providers: Stripe, HitPay and Airwallex today. Pehmen sends instructions; the licensed provider holds and moves the funds. Your credentials for each provider are yours, validated with the provider before they are stored, and encrypted so that only the worker that talks to the provider can read them.

Incident Center is cases, evidence and appeals, plus a narrow reconciliation of payouts against the provider's settlement reports, matched by reference and never by amount. There is also a savings simulation, which replays your imported history through a policy and reports what it would have held.

What it does to your day​

For an operator, the dashboard is a dossier. Each screen is a record. The manual walks every screen. For a developer, it is one REST API with three headers and a signed webhook feed; the developer center has the quickstart. For you, it is a set of questions that now have recorded answers: who is this seller, why did this payout go out, who approved that change, what did the rules say at the time.

Where it is honest about its limits​

Pehmen is not a fraud score for card-not-present payments, not a payment provider, and not a place where money sits. It does not make a platform scam-proof and it does not protect consumers' funds. What it does is make your own rules, your own data and your own verification steps enforceable, and make the record of them tamper-evident. The full list is on Boundaries.