Settings
PaySafe's operator-facing settings — every row carries a provenance link back to the substrate generator (or corpus injection) that produced it. Settings are read-only in this demo; in a real install they'd be operator-editable within the bounds the substrate's gate layer permits.
Tenancy + isolation
Substrate's multi-tenant generator wires per-row tenant_id NOT-NULL constraints on every entity and a query middleware that joins session.tenant_id into every read.
- Tenant isolation model
- row-level (RLS-equivalent)
- ↳ multi-tenant generator
- Cross-tenant query check
- enforced in middleware
- ↳ middleware generator
- Tenants
- acme-co · vendor-eu
- ↳ config generator
- Operator session TTL
- 30 min · refresh sliding
- ↳ auth generator
PCI-DSS scope
Stripe Connect generator scopes PaySafe to SAQ-A: PAN never touches substrate-emitted infrastructure. Tokenisation is delegated; the substrate handles only tokens.
- Substrate handles PAN data
- never
- ↳ stripe-connect generator
- Tokenisation provider
- stripe
- ↳ stripe-connect generator
- SAQ level
- A
- ↳ stripe-connect generator
- Network segmentation
- verified · operator-tier
- ↳ infrastructure generator
Webhook posture
Webhook generator emits signature verification + replay-window enforcement by construction. Webhook URLs must match the operator-configured allowlist.
- Stripe signature verify
- 100% · enforced
- ↳ webhooks generator
- Replay window
- 5 min
- ↳ webhooks generator
- URL allowlist
- api.stripe.com only
- ↳ webhooks generator + §66 Wire 4
Encryption + secrets
Drizzle schema generator marks PII columns as encrypted-at-rest. Secret rotation is wired into the API-keys generator.
- Customer PII encryption
- AES-256 · per-tenant KMS key
- ↳ schema generator
- IBAN storage
- deterministic hash only
- ↳ schema generator
- API key rotation policy
- ≤ 90 days · enforced by gate
- ↳ api-keys generator
- Hardcoded credentials check
- CWE-798 corpus test passing
- ↳ corpus injection · §47.6
Audit logging
Audit-log generator emits a hash-linked event chain. Every API mutation is appended; daily integrity verification runs at 03:00 UTC.
- Log storage
- immutable append-only
- ↳ audit-log generator
- Chain algorithm
- FNV-1a (demo) · SHA-256 (prod)
- ↳ audit-log generator
- Regulatory framing
- GDPR Art. 30 · AI Act Art. 12
- ↳ audit-log generator
- Daily integrity job
- 03:00 UTC
- ↳ background-jobs generator
Regulatory mapping
Substrate's regulatory generator emitted mandate-mapping rows for every fintech-relevant article in the operator's jurisdiction.
- PCI-DSS Level 4
- SAQ-A scoped
- ↳ stripe-connect + security-headers
- GDPR Art. 25 (privacy-by-design)
- enforced
- ↳ schema + audit-log generators
- GDPR Art. 32 (security of processing)
- enforced
- ↳ schema + security-headers
- PSD2 SCA
- ready
- ↳ auth generator
- EU AI Act Art. 9 (risk-mgmt)
- log retention + RTA
- ↳ audit-log generator
Source-of-truth links
Every setting above is governed by an ADR in the Promethean repo and reproducible from the deterministic factory layer.