First valid decision wins.
Concurrent or repeated clicks return the recorded result. Callback attempts keep the same approval ID so the receiving workflow can deduplicate safely.
TRUST CENTER / FACTS, NOT BADGES
Trust is what the system does when something goes wrong.
This page lists the behavior present in the public code today. It does not claim certifications, audits, or uptime history that do not exist.
open sourcesigned receiptsdurable retriesdefined retentiondelete controls
Decision and delivery
The decision is recorded before external delivery begins. A provider outage cannot turn an approved request back into a pending one.
Retries survive a restart.
Failed Slack, email, and callback deliveries are stored in SQLite and retried after recovery. Attempts and outcomes are recorded.
Opening a link is not a decision.
GET displays the review page. Approve and reject require an explicit POST, so an email security preview cannot decide.
Every final result is verifiable.
Decision receipts and callbacks use Ed25519 signatures. The public key and verification endpoint are public.
Retention and deletion
These are the hosted defaults in the current server code. A self-hosted operator can configure its own values.
90 daysfinal decision records
30 daysdelivery attempt details
365 dayssigned decision receipts
90 dayscompleted key requests
Delete one final approval: DELETE /v1/approvals/:id
Delete all data for a key: DELETE /v1/data with confirmation. Pending approvals must be decided or canceled first.
No proprietary exit trap.
The hosted product runs the public Node service with a persistent SQLite database. You can inspect it, fork it, and run the same API contract yourself.