The single most important architectural decision in Pontis is that we never take custody of client money. Funds sit in segregated accounts at a regulated banking partner; Pontis records claims and instructs release through a RailAdapter. It never holds a balance.
Why it matters
Custody is where the risk and the regulation concentrate. By staying non-custodial, the licensing posture is lighter, the path to market is faster, and — crucially — there is no Pontis float to mismanage. Your money is the partner's responsibility under its own terms; our job is to decide, provably, when it moves.
How it's enforced
A double-entry ledger keeps every movement balanced (Σ debits == Σ credits), checked in the app and by a database trigger. The account types make it impossible to imply Pontis owns client money. Posted ledger transactions are immutable at the database — corrections happen by posting a reversal, never by editing history.
What it means for you
Every buyer-facing surface states plainly: funds are held by a regulated partner, not by Pontis, and release only when the condition is verified. No 'custodial later.'