Refira is multi-tenant financial infrastructure. Isolation, authentication, encryption and reconciliation are properties of the system, not slides. Here is what is actually true.
Every payout crosses the same guarded path. Nothing skips a step.
Every casino is a tenant. Storage keys are scoped by tenant id, resolved from host, subdomain or session. The default tenant keeps unprefixed keys so production is unchanged, and every other tenant is fully namespaced.
Per-tenant operator accounts with scrypt password hashing and HMAC sessions carrying tenant and role. Roles are owner, finance and marketing. TOTP two-factor is required as a step-up before a payout executes.
A casino's own API keys are AES-GCM encrypted at rest, never stored in plain text and never returned. Custodial wallet keys come from a pluggable provider, KMS-ready. The publishable key is the only one that reaches the browser.
A payout id can never produce two transactions. The tx hash is written before broadcast, so a retry re-checks the chain instead of re-sending. Rate limiting on the money executor is fail-closed: if in doubt, it refuses.
Broadcast payouts are re-checked against the chain on a schedule and stuck ones flagged. Every state change is appended to an audit log with actor and reason. Monitoring watches for low gas and failed or stuck payouts, and the ledger is backed up with keys stripped.