What the approver sees, and what anyone can check afterwards — the walk under Controller · AP, drawn.
It runs inside what you already have.
Your systemsA payment is raisedBILL (Bill.com), Xero, Ramp, NetSuite, or one API call from anything else.
AvouchDecides each paymentYour rules, against your own history. Most clear untouched.
ApproverSigns on their phoneTold by email or Slack. They tap their own phone and never open this console again.
ReceiptSigned and loggedBound to that exact payment, in a public log.
AuditorChecks itWith no account, and without trusting us.
BILL (Bill.com) and Xero and NetSuite hold the payment and release it to exactly where it was. This connector does not hold Ramp bills: Ramp's hold endpoint is in beta and not yet adopted here. It reports which payments would have needed a signature; it cannot stop one. Nothing in a connector can approve anything — it has no method that could.
Replaying the month, payment by payment
Your AP systemraises a payment
→
Avouch decides210 decided
→
0 clearednobody interrupted
bank details changed 3 days ago
payee nobody has ever paid, large
known vendor, ten times the usual amount
a payee one character from one paid every month
one payment split three ways, each under the limit
dormant vendor, back at four times the amount
Decided 0 of 210 · 0 cleared · 0 stopped for a person
The pacing is a replay, not live traffic.
How it decides. Nothing hidden.
Each payment is compared with your own history by named checks, and your rules decide. Every decision is recorded with its reasons.
An example payment$186,400.00 to Halden Marine Services
Check
In your records
Bank details changed in the last 45 days
Changed 6 days ago
Flagged
More than 1.5× the largest paid to this payee
2.1× — the largest was $88,000
Flagged
A payee you have never paid
Paid 41 times since March
Clear
A name one or two letters from a payee you pay
No near match
Clear
Not paid in 180 days
Last paid 23 days ago
Clear
One payment split into 3 or more within 7 days
No split
Clear
Your ruleOver $50,000 and high risk→OutcomeHeld for a named approver, with a live check
Drawn. The engine has twenty-one checks; these six are the ones about the payee and the amount.
Is there a model trained on our data? No. Every check reads only your own records, and nothing is pooled across customers. Each one is a sentence your security team can read and argue with, which a trained model’s score is not. The policy decides what happens next, and you can tighten it.
What only a receipt can answer.
The questions an auditor asks after a payment, and who can actually answer them.
Your AP system’s logA compliance toolAn internal buildAvouch
Who approved this payment?A row the system wrote about itselfA copy of that rowA signature with your own keyA signature made on the approver’s own device
Was it this exact amount and payee?The log says soThe log says soIf you build the bindingBoth are inside the signature — change one character and it fails
Can someone outside check it without trusting you?Only by asking the vendorOnly by asking the vendorOnly by asking youYes: a public receipt and a public log, no account
The system that moves the money cannot be the one that vouches for it, and neither can you: a record you sign with your own key is still your own record. The key and the log sit with Avouch.
Watch it do what the others can’t.
Starts with nothing blockedShadow shows what it would stop before it stops anything.
Switching it on is signedTurning on enforcement is itself a signed, logged policy change.
Holds it in your systemThe connector holds the bill in your AP system. No code on your side.
Bound to the paymentChange one character of what was signed and the receipt fails.
Cannot be replayedThe same approval aimed at a second invoice is refused.
Cannot reset an accountA payment approval presented to the help desk is refused.
Nothing is blocked on day one.
Day 1ConnectPaste a token for your AP system. No code on your side.
Weeks 1–2ShadowIt only reads. You see what would have stopped, and how often.
ThenAdviseApprovers are told about risky payments. Still nothing is blocked.
When readyEnforceOne payment type, above one amount. Widen it when the numbers say so.
Walk one payment through it.
Eight short chapters: connect, watch in shadow, make a key, sign the switch, approve a $2.4M bill on this device, and check it like a stranger. About four minutes.