How we know the books are right
“Bank-grade security” means nothing — everyone writes it. Here are the actual mechanisms, what they prevent, and how to check them.
We do not hold your money
Funds stay in the approved provider’s segregated account. Kobri is never the custodian. If Kobri vanished tomorrow, the funds would not move — they are not with us.
Double-entry ledger
No balance is ever “edited”. Every movement produces two balancing entries, and the balance is a derived, recomputable view. The sum of all balances is exactly zero — otherwise there is an incident.
A franc cannot appear from nowhere
Money created without a counterpart is rejected by the database itself. This is not application logic a bug could bypass: it is a database engine constraint.
Nothing is ever erased
Ledger entries and the audit log are append-only. A mistake is corrected by a reversing entry, never by an edit. The history stays complete and defensible.
A log that reports on itself
Every log line carries the fingerprint of the previous one. Altering a line breaks the chain — including for someone with full database privileges. We verified this by doing it.
No operation ever runs twice
Every movement carries a uniqueness key. A network dropping at the wrong moment, a customer tapping twice: the operation executes once, and the replay returns the original result.
We tried to forge our own audit log
With full database administrator privileges and the protection triggers disabled, we modified a line in the audit log — the worst case, an attacker who has obtained everything.
verify audit chain
Break detectedcontent altered after write
The fingerprint chain flagged the tampering and named it. A ledger that can be quietly rewritten is worthless to a regulator — which is precisely why this one cannot be.
What it changes, depending on who you are
For the customer
- Receiving change never requires your PIN — if someone asks for it, it is fraud.
- Your phone never changes hands: you type the code yourself.
- A stolen code is worthless: three minutes, single use, fixed amount.
- Lost your phone? The device is revoked, your balance is untouched.
For the merchant
- You cannot give back more than you have funded — the database refuses it.
- In daily-code mode, your envelope caps the maximum possible loss.
- You revoke a code or a device in one click.
- Every operation is traceable and reconcilable against your till.
For the microfinance institution
- Funds never leave your segregated account.
- An integrity check runs continuously and can be queried on demand.
- The ledger is standard PostgreSQL, fully exportable.
- Your COBAC notification files are assembled and tracked automatically.
The limits, stated plainly
The service has not yet been audited by a third party. The mechanisms described here are verified by our own automated tests, replayed on every change. An external audit is a separate step, to be completed before opening to the public.
Daily-code mode is a deliberate trade-off. It exposes a secret that is reusable within the day, so that a shopkeeper without a till system can use Kobri. It is therefore capped, revocable and monitored — but it is less safe than the default mode, and we would rather write that down than leave it unsaid.
No system eliminates fraud. What you can do is make it expensive, bound its effects, and make it visible afterwards. That is what the caps, the ledger and the audit log are for.
A specific technical question?
We are happy to go into detail — data model, integrity tests, reconciliation procedure.