This page is for donors, auditors and anybody being asked to rely on a
LEAT payment record. It says what the record establishes and, just as
carefully, what it does not.
What a fully reconciled payment establishes
- An obligation was approved by named, eligible people, over exact content, with a proof that can be verified independently.
- A payment package was prepared and checked by a second person, and the check is bound to a fingerprint of exactly what was checked.
- The list and the total were frozen before the sheet left the building, and the fingerprint is printed on the sheet.
- A submission was recorded by somebody who was neither the preparer, nor the checker, nor a signatory on the account.
- The bank reported that this amount reached this beneficiary.
- The statutory accounts agree.
What it does not establish
- That the people on the bank mandate signed. LEAT is not present for that and holds no evidence of it.
- That they read what they signed, or signed freely.
- That the beneficiary was entitled to the money. That rests on the approval upstream.
- That goods or services were actually delivered. That rests on the module that approved the obligation.
What our tamper-evidence proves
LEAT records payment facts in an append-only journal and publishes
periodic checkpoints over it. That lets anybody establish that a recorded
event was included in a sealed checkpoint and has not been altered since.
It does not establish that a human observation was true, that a bank file
really came from the bank, or that an approved obligation was lawful. A
checkpoint proves the history has not been rewritten. It does not
promote a claim into a fact.
Numbers we will not add together
Reports separate these, and never collapse them into one number called
"spent":
- amount approved;
- amount reserved against budget;
- amount in frozen packages;
- amount submitted to the bank;
- amount confirmed as leaving our account;
- amount confirmed as reaching beneficiaries;
- amount rejected, returned or reversed;
- amount whose delivery is unknown.
The last one is published, with a count and a value. A report that hides
its unknowns is a report that has decided for you what they probably were.
There is no payment integration to compromise
LEAT holds no bank credential of any kind: no token, no certificate, no
banking login. There is no code in LEAT that can send an instruction to a
bank, and adding one would be a documented architectural change rather
than a feature.
Bank statements come in as read-only files. Money leaves only when two
people sign at the bank, using the bank's own controls.
