Pehmen

Released only when the evidence supports it.

Pehmen is the verified commerce control plane: decisioning, routing instructions and simulation over your own payment stack. Built for ticketing and events platforms across Asia that onboard organizers and pay them out. Pehmen never holds funds.

Connect your own sandboxExplore the seeded demo

You start in Test, on your own provider sandbox credentials. Live is separate, and gated.

The product, saying no.

Every decision is one of six words with a reason code from a fixed registry. No free text. A bad credential never even becomes a decision — it is refused before anything is stored. This is what that looks like, row by row, newest first.

Replayed decision records from the seeded demo workspace, test environment; newest first
TimeSubjectVerdictReason codeAction
14:03:21po_31f5aa…ALLOWCOOLING_OFF_SATISFIEDrelease instruction issued
14:03:07pi_09d6c8…STEP_UPATO_SESSION_RULEREQUIRE_STEP_UP
14:02:58po_a44c01…DENYFULFILLMENT_REVERSEDOPEN_CASE · HOLD_PAYOUT
14:02:44pi_b13e77…REROUTEROUTE_CIRCUIT_OPENROUTE_FAILOVER_PRE_COLLECTION
14:02:31con_5d08f2…REFUSEDLIVE_KEY_IN_TEST_ENVIRONMENTnothing stored
14:02:19po_e290b4…REVIEWPAYOUT_AMOUNT_ABOVE_THRESHOLDREQUIRE_SECOND_APPROVER
14:02:11bch_7c41a9…HOLDCOOLING_OFF_ACTIVEDELAY_PAYOUT_72H · NOTIFY_OLD_CHANNEL

Replayed from the seeded demo workspace — test environment. Synthetic subjects, real verdicts, real reason codes.

The machinery that said no.

Gate
The decision engine. Every evaluation returns ALLOW, STEP_UP, HOLD, REROUTE, REVIEW or DENY, with reason codes, a versioned policy behind it, and replay. You can open any decision and see exactly which rule fired.
Envelope
Changing a seller’s bank account starts a cooling-off period, notifies the old channel and the new one, and needs a second approver. Beneficiary bindings are signed by a key the application itself cannot reach.
Test ≠ Live
Test and Live are separate connections and separate data. A live-prefixed key pasted into a test connection is refused before anything is stored — LIVE_KEY_IN_TEST_ENVIRONMENT, not a warning banner.
Cases & audit
Holds open cases with hashed evidence bundles and appeals. The audit history is hash-chained and append-only: yesterday cannot be quietly rewritten.

Every payment carries its reasoning.

A routed payment stores the candidates it considered, the filters each one passed or failed, and the arithmetic that picked the winner. The screen renders that record — it does not recompute it.

rd_04c81b…  ROUTE DECISION            for pi_9e2f70…   S$ 184.00
CANDIDATES  3
con_2f11d8… stripe    PASS contract  PASS currency  PASS health   score 0.91
con_8ab30c… hitpay    PASS contract  PASS currency  FAIL health   ROUTE_UNHEALTHY
con_c94e51… airwallex FAIL amount range                           ROUTE_AMOUNT_OUT_OF_RANGE
WINNER      con_2f11d8…                                           ROUTE_SCORE_WINNER

Synthetic record, real schema. You will see your own within the hour.

Built for platforms across Asia that pay out organizers.

Ticketing, events and experiences platforms across Asia: marketplaces and vertical SaaS that onboard organizers or resellers, pay them out through licensed providers, and own the risk when a payout goes to the wrong hands — hijacked organizer accounts, redirected beneficiary changes, refund storms when an event cancels.

We will not

Link to routed test payment. Under 30 minutes. Nobody calls you.

  1. 00:00

    You are here.

  2. ~00:02

    Open the seeded demo — a full workspace, already populated, no account needed.

  3. ~00:10

    Create an account and connect your own sandbox: a Stripe test key, a HitPay sandbox, or an Airwallex sandbox. A secret key is refused — SECRET_KEY_NOT_ALLOWED_USE_RESTRICTED — so mint a restricted one.

  4. <00:30

    Run test traffic. Watch the decisions, the traces and the payout workflow happen on your own keys — the only convincing version of any of this.

Connect your own sandbox →

or explore the seeded demo · read the docs · sign in