Live reports
derived, never reconciled
P&L, balance sheet, and trial balance are views over the same rows the engine wrote — no sync step, no end-of-day batch.
Architecture
How Paprel Is Built
The architecture your security and platform reviewers will ask about, stated plainly: how a request becomes a ledger entry, how tenants stay isolated, what the webhook contract guarantees, and how the system deploys. None of it is aspirational — this is the structure running in production today.
From API call to balanced books
Every write — direct journal, invoice, payment, agent tool call — passes the same gates, in the same order. Nothing reaches the ledger unverified.
Your platform
REST · SDK · MCP
One surface, three ways in. The same primitives whether the caller is your backend, a typed SDK, or an AI agent over Model Context Protocol.
Auth & scope
OAuth 2.0 · tenant-scoped
Every token is scoped to a company with per-route grants. The same model powers dashboards, machine clients, and MCP agents.
Idempotency check
seen before? → original result
Supported requests use idempotency keys under the endpoint contract. Follow the endpoint requirements; idempotency is not an unconditional guarantee against duplicate actions.
Balance validation
debits = credits, or rejected
Checked at write time, before anything reaches the ledger. Validate the supported posting behavior and account mappings for your integration.
Append-only ledger
corrections are new entries
Posted lines are never edited in place. Versioned documents keep a stable anchor while the full history stays walkable.
Signed webhooks
at-least-once · verifiable
Events carry timestamped HMAC signatures over the exact raw request body so consumers can verify integrity and dedupe redeliveries.
The layered core
Four layers, one set of guarantees
Workflows never bypass the ledger; reports never drift from it. Each layer either compiles into the layer below or derives from it — which is why there is no reconciliation step anywhere in the stack.
Read the full layer-by-layer articleReporting layer
Derived live from journal rows
Reports are views over the ledger, not a second datastore that gets synced and reconciled. The trial balance ties to zero by arithmetic, not by health check.
Workflow layer
Documents compile into journals
Invoices, bills, credit notes, and expenses generate balanced journals through account mappings set once. A compiler into the ledger's guarantees — never a bypass.
Ledger engine
Append-only · balanced or rejected
Journals are the only primitive. If a number appears in a report, there is a journal line behind it — balance-validated at the API boundary.
Tenancy
Isolation enforced at the data layer
A company identifies a set of books and reporting scope. Confirm tenant access enforcement and privileged paths for your deployment.
A company is the boundary
One API call provisions a customer with isolated books of their own — ledger, document numbering, and a default chart of accounts included.
Your platform
one tenant per customer · OAuth-scoped tokens
Customer A
region: US
- Own ledger & chart of accounts
- Isolated at the data layer
- Own audit history
Customer B
region: EU
- Own ledger & chart of accounts
- Isolated at the data layer
- Own audit history
Customer C
region: APAC
- Own ledger & chart of accounts
- Isolated at the data layer
- Own audit history
Confirm the company boundary, enforcement design and privileged access paths for your deployment. Example regions in this diagram are illustrative, not a residency commitment.
Safe to retry, built to verify
Every financial API eventually receives the same request twice. In a ledger, a duplicate write isn't a duplicate row — it's an audit problem. So the write path assumes retries.
Retries are the normal case
Timeouts, webhook redeliveries, queue replays — the write path is designed to be retried, because it will be. Idempotency keys deduplicate; resubmitting a journal returns the original result.
Signed, verifiable delivery
Webhooks are delivered at-least-once with timestamped HMAC signatures over the exact raw request body, so a consumer can verify integrity and safely ignore duplicates.
Recovery beyond redelivery
Automatic retries and operator resend recover individual deliveries. For wider gaps, consumers reconcile against company-scoped APIs and ledger exports—the accounting data remains the source of truth.
Audit history, exportable
Confirm the activity history, evidence format, export coverage and retention agreed for your service.
Three ways to run it
The ledger core and its guarantees are identical across all three — the models exist for distribution and compliance shapes, not as upgrades.
Managed
Paprel hosts, you integrate
- Hosting region, support access and onward processing locations are agreed for each deployment
- Sandbox is self-serve; production starts at published pricing
- Sandbox and production are separate, isolated environments
The right starting point for almost everyone.
White-label
Paprel powers, your brand fronts
- Every tenant carries your partner attribution — your customer relationship, end to end
- Headless API under your brand — your UI and domain, Paprel underneath
- Managed responsibilities are defined by the agreed service scope
For platforms that own the accounting experience.
Private / BYOC
Your cloud, scoped together
- Deployment in your infrastructure or on dedicated infrastructure
- Scoped per engagement — conversation first
- Operational and security responsibilities are agreed per deployment
For compliance shapes managed can't express.
Go deeper
The long-form versions
This page is the map. Each area has a full engineering write-up in the documentation — the same documents we point security reviewers at during evaluation.
See the security & trust postureTenancy, isolation, and the ledger core
Company-per-tenant isolation, the append-only engine, and reports derived from the same rows.
Read the articleWebhooks, idempotency, and reliable writes
Why retries are assumed, how the write path stays safe under them, and the signed webhook contract.
Read the articleDeployment models: managed, white-label, private
What each model actually is, when it's the right call, and what never changes between them.
Read the articleArchitecture review
Bring your hardest questions
Talk directly to the engineers who built and operate the ledger — deployment fit, OAuth and MCP scope, data residency, and rollout, in a working session.