RevenuePilotby Foxes TechnologyRevenue decisions are questioned long after they are made—by a partner, a finance review, or by the person who made them. RevenuePilot records the evidence at the moment of the decision, so the answer is retrievable instead of reconstructed.
A receipt is not a log line written after the fact. It is assembled as the recommendation is produced, so the evidence and the decision cannot drift apart.
| Receipt element | What it records | The question it answers |
|---|---|---|
| Signal and source snapshot | The reconciled source state the decision was derived from | What did we actually see |
| Economics used | The variable cost and commission arithmetic applied | How was the impact calculated |
| Uncertainty | The confidence and the gaps that remained in the evidence | How sure were we |
| Policy boundary | The guardrail that shaped, capped or blocked the move | Why not further |
| Operator action required | The specific action put in front of a person | What were we asked to do |
| Outcome | What happened to the recommendation afterwards | What did we do, and what followed |
Evidence that can be edited is not evidence. The audit trail is written once and never rewritten, and every entry names an actor as well as an action.
Entries are added, never amended in place. A later correction is recorded as its own entry alongside the original, so the sequence of what was known and when remains readable.
Approvals, policy changes, connector work and execution attempts record the acting identity and the time, so a review does not depend on anyone remembering who pressed the control.
Audit and receipt data is tenant-scoped behind forced PostgreSQL row-level security, so isolation is enforced by the database rather than by a filter someone might forget to write.
Where a certified connector and explicit approvals exist, execution produces its own evidence chain. Each step below has to succeed before the next one is attempted.
The write is fenced against the price version it was calculated from. If the value changed underneath us, the write is refused rather than overwriting someone else's change.
Every write is keyed so that a retry or a replay cannot apply the same change twice. A repeated attempt resolves to the original result instead of compounding it.
The applied value is verified against both the machine read and the public quote. Agreement between the two is what counts as applied—not the fact that a request returned successfully.
The attempt, the actor, the verification result and the resulting state are sealed into a downloadable receipt attached to the decision it came from.
A verification mismatch triggers version-fenced rollback. If the rollback itself fails, the system locks writes for the whole organization rather than continuing in an unknown state.
The most damaging thing a revenue system can do is present a confident number built on a default value. RevenuePilot separates what is missing from what is zero.
Evidence held only inside a vendor interface is fragile. Both export paths below produce data you keep, with secrets deliberately excluded.
The audit trail as a file you can open in a spreadsheet or hand to a reviewer. Server-entitled to the Growth and Scale plans.
An owner-only export of the workspace, protected by TOTP step-up, for portability and for lifecycle events such as an export-only wind-down.
Exports omit connector credential ciphertext, ingestion-key hashes and raw imported objects. Portability should not become a second copy of your secrets.
Collapsing these into a single headline number is how revenue tools produce results nobody can reproduce. They are kept separate throughout.
| Value | What it represents | What it does not prove |
|---|---|---|
| Estimated | The modelled impact of a proposed decision | That the change was made or accepted |
| Executed | A change that was applied through the execution path | That the applied value was confirmed downstream |
| Verified | An applied change confirmed by machine and public read-back | That margin moved as a result |
| Realized | Measured outcome against an approved control | Anything, without that control in place |
No. The audit trail is append-only. A correction is recorded as a new entry beside the original rather than replacing it, so the sequence of what was known and when stays intact.
Read-back verification. The applied value is checked against both the machine read and the public quote, and the receipt records that result. A request returning successfully is not treated as proof on its own.
The gap is shown rather than filled. Missing variable cost or unreconciled source data is flagged and the affected recommendation is withheld, instead of being ranked on arithmetic built from a default value.
Yes. Audit CSV export is entitled to the Growth and Scale plans, and an owner-only, TOTP-protected organization JSON export covers portability. Both exclude connector credentials, key hashes and raw import objects.
Evaluate the evidence trail on a scoped portfolio, in advisory mode, before any connector is certified for writes.