Muntin Ledger

Words we use, and what they mean.

Our product copy uses a handful of engineering terms. Each one is on this page in plain operator language. If a term in the product is missing here, tell us at hello@muntin.digital and we will add it.

attestation

A signed statement we publish on a schedule so anyone can check that our books match the audit log byte for byte.

See also: audit chain, chain head, ed25519

audit chain

An append-only log of every move on your workspace. Each entry links to the last one with a hash so a missing entry shows up at verify time.

See also: chain head, attestation, tombstone

bbox

Bounding box. The rectangle around a field on the page (the four corners of where the total sits). It records where on the page each field was read.

See also: fingerprint, template

BYOK

Bring Your Own Key. You hold the master key in your own KMS account; we hold an envelope we cannot open without you.

See also: KMS, posture

chain head

The newest entry in your audit chain plus a signature. We sign one every six hours so you can verify the whole chain off-host.

See also: audit chain, attestation, ed25519

cron

A scheduled job. The retention reaper, the weekly digest, and the chain-head signer all run on cron schedules.

See also: DLQ

DLQ

Dead-letter queue. When a job fails three times in a row, we park it here so on-call can look at it without losing the work.

See also: idempotency, webhook

drift

When a vendor changes their invoice layout. We flag the moved fields so you can confirm them in one tap.

See also: template, fingerprint

ed25519

The signature scheme we use to sign the audit chain head. Small, fast, and the verifying key is published so anyone can check our signatures.

See also: attestation, chain head

fingerprint

A short tag we attach to one piece of an invoice (a total, a date) so we can tell if it stayed in the same spot on the page.

See also: template, drift, bbox

idempotency

Sending the same request twice has the same effect as sending it once. We use this to retry safely after a network blip.

See also: DLQ, webhook

JWT

A short signed token your browser sends with each request. It tells us who you are without us holding a server-side session for every tab.

See also: kid, OAuth

kid

Key ID. A tag on a JWT that names which signing key we used. Lets us rotate keys without invalidating every active session at once.

See also: JWT, attestation

KMS

Key Management Service. A separate vault that holds the keys we use to encrypt your stored data. Even our database admins cannot read the keys.

See also: BYOK, RLS

OAuth

The way one app gives another app permission to act on your behalf. We use it to post to QuickBooks or Xero without holding your password.

See also: webhook, idempotency

pii scrubber

A small filter that strips names, emails, totals, and other personal data from logs and error reports before they leave our infrastructure.

See also: posture, audit chain

posture

A one-line summary of where your data lives, how long we keep it, and who can read it. Always visible at the top of the page.

See also: audit chain, RLS, KMS

reconciled

The printed total on the invoice matches the line items added up. When they do not match, we flag the row for you to check.

See also: residual, template

regret rate

How often we promote a template rule and then have to drop it after your next correction. A high rate means we promoted too soon, not that you were wrong.

See also: template, drift

residual

The gap between the printed total and the math. A residual of $1.20 means the invoice prints a total that is $1.20 off from its own line items.

See also: reconciled

RLS

Row-level security. A wall the database enforces so one workspace cannot read another workspace's rows, even with the database password.

See also: posture, audit chain

ship_to_region

The state or country a line item is shipped to. Drives the sales-tax math on multi-state vendors.

See also: vendor override

template

A saved layout for one vendor's invoice. Once we have one, the next invoice from that vendor arrives pre-filled.

See also: fingerprint, drift, vendor override

tombstone

A marker that says a record was deleted, without keeping the record itself. The audit chain stays whole even after a delete.

See also: audit chain

vendor override

A rule you set for one vendor that beats the default. Useful when one vendor posts as an expense and the rest post as bills.

See also: template

webhook

An HTTP call we make to your books app the moment something happens here. The other app gets a small JSON body and a signature it can verify.

See also: DLQ, OAuth, idempotency