Every batch is checked before it lands in the ledger.
Observations arrive bucketed and anonymised. Prices, deal ids, counterparty names and account identifiers are refused at ingest, and each accepted batch is linked to the one before it. The audit log refuses every update and delete at the database itself.








