Verify payment changes outside the inbox.

No. ProofRelay never touches funds and has no banking integration. It controls the decision — whether a changed payment detail is verified and approved — and issues a release reference your team checks before paying through your normal banking channel.

Every rule runs on the server in a single atomic transaction: the requester can never verify or approve their own request, and verification can only use pre-established contacts. The UI is a convenience — it is not the enforcement layer, so there is nothing to click around.

On approval, ProofRelay issues a code bound by a SHA-256 hash to the exact amount, currency and destination that were verified. Anyone on your team can validate it before paying — validation recomputes that hash from the live record, so if any material detail changed afterwards the reference is revoked on the spot rather than quietly passing.

That is the exact case ProofRelay is built for. The change is logged, a colleague calls a contact your team established before the request existed, and someone other than the requester approves. A genuine change passes in one phone call; a fraudulent one fails the callback.

First payments are where much of this fraud actually happens — a fake or hijacked first invoice, with no history to contradict it. When you add a supplier you've never paid, their account details enter as a request to verify, not as something trusted: you establish a contact from an independent source (their contract, the ABN register, their official website — never the invoice itself), a colleague calls, and approval creates the first verified account. Until that completes, the payment-run check flags any batch line paying them.

The workflow implements the controls the Australian Cyber Security Centre publishes for preventing business email compromise (cyber.gov.au): an approval process for payment-detail changes and large transfers, verification by calling the sender on a known number — never one from the email — and treating urgency, secrecy, and requests to bypass procedure as red flags. The lookalike-domain detection covers the ACSC's published impersonation patterns, from swapped characters to added words. ProofRelay is not affiliated with or endorsed by the ACSC; it automates the controls they recommend.

Yes. An administrator can generate a public verification link for any live release reference and send it to the supplier — or anyone else who needs assurance. The link shows only the status, organisation and supplier names, amount, and a masked destination. It can be rotated at any time, every check is recorded in the audit trail, and a material change revokes it automatically.

No — deliberately. Twenty-three deterministic rules check things like changed destinations, first payments to unknown suppliers, lookalike sender domains (one character away from a domain you trust), accounts previously rejected by your organisation, one account claimed by two different suppliers, destinations moving offshore, and urgency or secrecy language. Every indicator states exactly why it fired, so your team and your auditors can reason about it.

Under an hour for most teams: create your organisation, add suppliers with their known-good payment details from your accounting system, and establish trusted contacts. Your next payment-detail change then goes through the verified path.

Yes — free forever, with the complete verification workflow, all 23 risk indicators, and the tamper-evident audit trail for up to five suppliers and three team members. It is the full product, not a trial. You outgrow it by adding suppliers, not by hitting a paywall on security features.

Not during early access: add every client organisation free, with no payment details and no client limit. Each client keeps its own suppliers, policies and tamper-evident audit trail, and your team sees one portfolio view across all of them, ranked by what needs attention. When billing arrives it will land on the Firm tier first, and practices already on board will hear about pricing before it applies to them.