Immigration data is passports, bank statements and biometrics. Trust is the product, not a feature.
Money that must not half-move.
Escrow is the whole product promise, so the state machine is the whole engineering problem. Every transition has to be idempotent and every webhook replay-safe — a transfer that half-completes is worse than one that fails outright. Disputes can freeze the flow at any point without stranding either side.
fund → milestone → releasedispute hold
Row-level security, in practice
A client can't reach another client's documents or chat; a consultant can't see a case they don't belong to. Enforced in Postgres, not in the app layer — and trust fields stay unwritable from the client entirely.
Postgres RLSservice-role writes
Erasure that actually erases
Tenant isolation, row-level access and crypto-shredding for erasure — designed for KVKK and GDPR from the schema up, not bolted on before launch.
KVKKGDPR