| Auth model |
OAuth + custom grants |
Unified |
| KYC architecture |
Ports & adapters |
Pluggable KYC providers |
| Palm architecture |
Ports & adapters |
Pluggable palm vendors |
| Repo structure |
Hexagonal |
Clean separation |
| Social login |
Google + Apple |
User convenience |
| Account linking |
Auto-link |
Seamless UX |
| Tenant model |
All capabilities available to all tenants |
No tenant types — each tenant configures individually |
| Access control |
RBAC with 5 roles |
Clear separation between platform ops, tenant management, and API access |
| Tenant isolation |
Logical (tenant_id on all entities) |
Simpler than physical separation, sufficient for security requirements |
| Console users |
Separate from end users |
Avoids conflating managed identities with platform operators |
| Full OIDC |
Not included |
Post-MVP. May be added when third-party 'Login with Link' is needed. |