Security built around one rule

A device has to be verified and trusted before it can run automated transactions for a station.

• New devices are enrolled deliberately, not automatically
• Trust is scoped to a station — a device trusted for one station isn't trusted for another
• Replacing a device means re-establishing trust, not inheriting it

SIMs are bound and verified per device, so an unauthorized SIM swap can't silently take over a line.

• Each SIM is tied to the device it was enrolled on
• Swapping a SIM into an untrusted device breaks the binding rather than transacting silently
• Multi-SIM stations keep each line's trust independent of the others

One score rolls up device and SIM trust across an entire station, giving a station manager one reliable signal instead of a device-by-device checklist.

• Combines Device Trust and SIM Trust at the station level, not just per device
• Feeds the Unified Runtime Policy that decides what's allowed to run automatically
• A restored or replaced device starts at an intermediate trust level, never full trust by default

The policy layer decides what Runtime V2 is allowed to automate — and where a human has to confirm — from the trust signals above.

• Organizations set the policy; the runtime enforces it, not the individual agent
• Every automated step still surfaces to the agent for confirmation before it commits
• Trust engines never block a transaction directly — only the policy layer decides

Checks available balance before every transaction, so an impossible transaction is refused before it costs money, not after.

• Verified balance is checked against amounts already reserved before authorizing a new dial
• An unknown balance blocks the transaction the same way an insufficient one does
• Field-validated on real hardware — not just designed in theory

Mobile Money PINs are sealed in the Android KeyStore on-device — hardware-backed where the device supports it.

• PINs are never transmitted off the device
• PINs are never included in cloud sync, backups, or transaction metadata
• Any biometric change or tamper attempt purges the PIN vault entirely

AES-256-GCM encrypted backup and restore of a station's configuration — never including transaction PINs, which stay bound to the device that holds them.

• Financial data is explicitly excluded from export and import
• Restore runs as an atomic pipeline, with an explicit on-screen confirmation step
• Restoring a station onto a new device means re-entering PINs there, never migrating them

Runtime V2 behaves identically on every run, on every device — consistency is what makes automation trustworthy.

• Runtime V2 remains the sole execution path for automated USSD sequences
• No persistent trust session by default — every transaction requires active confirmation
• Behavior never varies by device, station, or SIM in use

Every transaction and every security-relevant action is recorded — never edited or deleted after the fact.

• Every correction becomes a new, approved entry, never a silent edit to an existing one
• Gives organizations a complete, tamper-evident audit trail
• The same discipline that protects your transaction data protects the history itself

Turns Mobile Money confirmation SMS into structured transaction history through one closed pipeline — never interpreted ad hoc by whichever feature happens to need it.

• A single entry point for SMS interpretation, never consumed directly by a feature
• Field-verified for MTN Ghana and MTN Bénin
• Acts as an independent safety net for resolving a transaction that's still pending

Instantly hides balances, amounts, and names on screen, across every view in the app — useful the moment someone's looking over an agent's shoulder.

• Toggle it in one tap from the dashboard or settings
• Never masks fields being actively entered, so a privacy feature never becomes a safety regression
• Cloud sync exists for configuration and metadata — never for anything that could reconstruct a PIN