How it works
Every milestone linked in a single line.
Move away from disconnected tracking. TraceTxn monitors and anchors every stage of the customer journey, from order created to the final payment ledger event, on one canonical chain every surface reads in realtime.
TraceTxn · order lifecycle
ORD-260805-K4M9P2RT3W
One canonical chain · backend authority · realtime push
Lifecycle ledger
10 canonical states- 08:13:35
Order created
Agent · Mira Holst
- 08:13:53
Gateway selected
Stripe · frozen for this order
- 08:13:53
Payment link generated
Session cs_test_a1B2c3…
- 08:14:46
Email sent
Consent record created in lockstep
- 08:21:22
Consent received
Customer · IP 73.114.142.18
- 08:21:30
Payment started
Customer reached the gateway
- 708:21:35
Paid
Webhook reconciled · pi_3R7kx2KZ4m…
- 8-
Confirmation sent
Receipt delivered via durable outbox
- 9-
Refunded / Failed
Refund + failure paths preserve the chain
Backend authority, never UI optimism
Every status badge in TraceTxn derives from the canonical chain. The dashboard, the order detail, and the dispute log all read the same record at the same time. No shadow store.
- One canonical row per order, queried by every surface
- No client-side state that diverges from server truth
- Dispute review and customer page read the same record
Idempotent webhooks, atomic writes
Duplicate Stripe deliveries collapse to one transition. Stamping a row as paid writes the audit, the event, and the outbox inside a single transaction boundary.
- Webhook dedupe at the processed_webhook_events collection
- Status, audit, event, outbox in one withTx() call
- Concurrent webhook + reconcile races collapse at the index
Realtime push, polling backstop
The operator's surface receives SSE updates the moment the webhook fires. If the connection drops, polling fills the gap so the canonical record never disagrees with what's on screen.
- Per-tenant SSE channel scoped to the actor's org
- Order-detail queries auto-poll while status is non-terminal
- Reconnect on tab focus, no missed transitions on sleep
Refunds and failures preserve the chain
Refunded orders never delete. Failed orders never delete. Risk-flagged orders persist through archive. A dispute six months later still has a complete artifact.
- Append-only evidence rows enforced at the model layer
- Archive flips state, never removes the chain
- Hash-linked events let the bank re-verify integrity
Who it's for
Built for Shopify, e-commerce, and modern digital engines.
Whether you are scaling a Shopify storefront, a B2B SaaS platform, a high-ticket agency, or a productized consulting business, if your payment records are disconnected from your application logs, you are bleeding revenue.
One backbone, shaped to your business
itemType · attributes · evidence- Shopify / E-commerceorder_linesku · variant · fulfillmentgateway receipt + delivery proof
- B2B SaaSsubscriptionplan · seats · billing_periodinvoice + consent-to-charge trail
- Agencyengagementscope · milestone · ratesigned SOW + delivery sign-off
- Productized consultingpackagedeliverable · revision_cap · termacceptance + completion record
- Retail / DTCproductsku · size · color · imagegateway receipt + delivery proof
- B2B invoicingnet_invoicepo_number · terms_days · contract_refPO match + remittance trail
Not listed above? The same backbone carries it, the catalog editor accepts any shape. Define your item type, declare your attributes, run your first order, and every payment record stays anchored to the application event that produced it.
Features
Core features built for high-signal operations.
Six capabilities, every one of them shipped. The sections below walk each in depth, this is the map.
Hashed evidence chain per order
Every transition appends a SHA-256-linked event. When a chargeback lands weeks later, the dispute artifact is already built, exportable as a bank-grade PDF.
Every milestone anchored to the ledger
Order, link, consent, payment, refund, each stage links to the canonical chain. No transaction floats free of the event that produced it.
Append-only audit log
Typed rows carry actor, IP, user-agent, and metadata. Not editable, even by admins. The record an auditor or bank can re-verify on demand.
Gateway-agnostic orchestration
Connect your own Stripe in 60 seconds, your keys encrypted at rest. Routing, webhooks, and reconciliation run through one contract per provider.
Consent captured before the charge
Hosted, token-bound consent freezes IP, user-agent, and signed name onto the chain, the strongest signal a card network reads in a dispute.
Realtime canonical record
SSE push the moment a webhook fires, polling backstop behind it. Reason-code analytics surface why losses happen, not just that they did.
Comparison
Infrastructure-grade tracking vs. basic bookkeeping.
Bookkeeping records what happened. TraceTxn proves it, link by link, in a form the bank and the auditor can re-verify.
TraceTxn
Payment operations
Bookkeeping + processor dashboard
The status quo
Transaction traceability
A hashed chain links every milestone to its payment ledger event.
Orders, logs, and payouts live in separate systems; reconciliation is manual.
Evidence generation
The dispute artifact is assembled inline, exported as a bank-grade PDF.
Evidence is gathered by hand, after the chargeback has already landed.
Dispute readiness
Consent, IP, and the full timeline are frozen at dispute time.
Screenshots and email threads stitched together under a deadline.
Operational visibility
One canonical record, pushed realtime to every surface that reads it.
Status lives in spreadsheets, inboxes, and someone's memory.
Payment infrastructure
Gateway-agnostic orchestration on your own keys, encrypted at rest.
Locked to a single processor's dashboard and its export limits.
Every order opens a case file the moment it's created. Items, customer, gateway selection, consent signature, every email, every gateway round-trip, all written into a hashed chain as they happen.
When a dispute arrives, weeks later, the artifact is already built. The operator clicks Export PDF and forwards a bank-grade document, the one rendered below is the actual surface, not a marketing facsimile.
TraceTxn · case file
ORD-260805-K4M9P2RT3W
Generated 2026-05-26 08:14:35 UTC · 9 events · Integrity VALID
Order evidence - ORD-260805-K4M9P2RT3W
Chain integrity verifiedOrder summary
Customer
Amount
Status
Provider
Vehicle
Evidence timeline
(9 events)- 122:13:35
Order created
Agent · Mira Holst
- 222:13:53
Payment gateway selected
Agent · Mira Holst
- 322:13:53
Payment link generated
Session cs_test_a1B2c3… · Intent pi_3R7kx2KZ4m…
- 422:14:46
Payment request email sent
- 522:14:35
Consent requested
Token cda61ecc5b18eb96…
- 622:21:22
Consent received
Customer · Talia M. Berenson · IP 73.114.142.18
- 722:21:35
Payment completed
Gateway Stripe · Intent pi_3R7kx2KZ4m…
- 822:21:35
Confirmation email sent
- 922:21:35
Order confirmed
System
Evidence integrity
Each event is cryptographically chained. Any tampering would break the chain.
Same panel, four states
READY · OPEN · WON · LOSTDispute-ready
- Evidence
- 9 events
- Consent
- Signed 08:21:22
- Integrity
- Valid
Awaiting outcome
In dispute
$2,840
- Reason
- 13.1
- Opened
- 2026-05-05
- Deadline
- 2026-05-12
Reversed in your favor
Recovered
$2,840
- Reason
- 13.1
- Decided
- 2026-05-21
- Outcome
- Won, Reversed
Decided against
Lost
$2,840
- Reason
- 10.4
- Decided
- 2026-05-18
- Outcome
- Lost
Most orders sit at READY. OPEN lights up when a chargeback arrives; WON or LOST when the bank decides. Same shell, four variants, no separate dispute surface to navigate.
- Webhook idempotency
- 100%
- Drift between surfaces
- 0
- Evidence retention
- ∞
Every gateway event collapses to one transition.
One record · realtime push + polling backstop.
Paid, refunded, disputed, kept forever.
Compliance isn't an export feature. It's the schema.
Every record TraceTxn writes is shaped for the conversation finance has with auditors and banks. Actor identity, request context, hash linkage, and immutability proofs are storage primitives, not a reporting layer added on later.
Backend authority, never UI optimism
Every status badge derives from the canonical record. The dashboard, the order detail, and the dispute log read the same row at the same time.
Append-only audit log
Typed audit rows with actor, IP, user-agent, and metadata. Not editable, even by admins.
Hashed evidence chain
Per-order events chain-hash to the previous entry. Any rewrite breaks the chain, provable to disputes and regulators.
Atomic webhook handling
Idempotent, defensively ordered, conditional updates. Duplicate Stripe delivery is a no-op. Retried reconcile is a no-op.
Operations-grade idempotency
Consent recorded once. Confirmation emails sent once. Refunds ratchet forward, never backward.
Retention by design
Paid orders never delete. Refunded orders never delete. Risk-flagged orders persist through archive, surfaces dim, records stay.
One gateway in production today. Four more, one adapter away each.
The orchestration layer under TraceTxn was built gateway-agnostic from day one. New adapters slot in without rewriting the order lifecycle, the webhook contract, or the audit chain, they implement one interface and the rest of the platform doesn't know which provider routed a specific charge.
Routing precedence: per-order override → org default → registry default. Normalised VerifiedPaymentEvent shape across providers.
interface PaymentGateway { // Stable identifier + admin label. key: PaymentGatewayKey; label: string; enabled: boolean; // One contract, every adapter. createSession(input): Promise<CreatedSession>; verifyWebhook(body, sig): VerifiedPaymentEvent; getSessionStatus(id): Promise<SessionStatus>; expireSession(id): Promise<void>;}Live
- StripeCheckout · webhooks · disputes · refunds in production
- ManualWire · ACH · any out-of-band capture flow
Next
- RazorpayAdapter scaffold ready · India-region routing
- Authorize.netAdapter scaffold ready · activation on credentials
Roadmap
- AdyenCard-present + 3DS routing under design
- PayPalMarketplace flow under design
Setup
Create the workspace. Run your first paid order before the day ends.
Item types, orders, evidence, and consent are universal primitives. Pick a vertical template, connect Stripe, run a real order through the lifecycle, all of it inside your tenant from the first minute.
Create your workspace
Sign up, name your business, pick a vertical template (retail, services, rental, repair, dealership, generic). The catalog seeds itself; the operator console is live.
Connect Stripe
One-click test, auto-registered webhook endpoint, deep links into your Stripe dashboard. Razorpay and Authorize.net adapters slot in next.
Run your first order
Catalog, order, payment link, consent, paid. Every transition recorded on the evidence chain from minute one.
What every workspace gets
- Org-isolated data, your tenant, your records
- Branded customer-facing payment pages
- Role + permission matrix (Admin, Staff, custom)
- Audit-grade hashed evidence chain
- Hosted consent capture
- PDF + CSV dispute exports
- Realtime SSE lifecycle updates
- Stripe live, Razorpay + Authorize.net adapters next
Side door
For custom, high-volume, or procurement-led setups.
Most teams start free and grow from there. If you need scoped routing, regional gateway selection, a procurement track, or volumes that warrant a dedicated conversation, tell us about it and we'll respond within one business day.