A modern, edge-native platform for 0% owner-financed deals. The seller and the buyer find each other, sign with each other, and pay each other directly, bank to bank. qardon.com never holds money, runs no credit check and approves no one. Built by Fotoh, Inc.
Non-confidential summary of platform functions. Implementation details and IP remain proprietary.
Three-path application intake (auto, conversational, self-service), automated assessment on behaviour and capacity-to-repay, audit-logged human review for edge cases, and FCRA-style adverse-action notices when applications are declined. The decisioning surface is specified, not built; nothing sends a notice today.
Each contribution is tracked as a perpetually-revolving entry. Contributors see how many cycles their contribution has completed and how many beneficiaries it has served — never identifying details.
Each person holds an investment account in his own name (Alpaca). Money moves between people’s own accounts; the step to or from a bank is the account platform’s own. Fotoh runs no card processor and no crypto rail, and holds nothing. Idempotency keys and a record of every payment.
Specified, not yet built: OFAC sanctions screening, BSA/AML transaction monitoring, KYC identity verification, an ECOA non-discrimination audit trail, an FCRA-compliant adverse-action workflow, GDPR + CCPA subject-rights tooling. It is designed in detail and none of it is running — which is why the list below says so item by item instead of leaving you to assume.
Treasury views, application queues, repayment forecasts, fraud-pattern alerts, export of your own Form 990 inputs if your organisation files one, audit packs for regulators and external auditors.
Multi-tenant architecture lets a single deployment host multiple operating nonprofits with isolated data, branded surfaces, and per-tenant policy.
Sub-second response anywhere on Earth. No origin server. No scaling cliff. No idle capacity.
Cloudflare Workers — V8 isolates on 300+ edges. P50 latency under 50ms. Zero cold-start tax above a baseline. Cost-aware by design.
D1 for SQL (members, contributions, applications, ledger). R2 for object storage (claim documents, audit packs). KV for low-latency reads. Vectorize for RAG retrieval.
Workers AI hosts the LLaMA model used for conversational application intake and RAG-grounded answers. Inference runs at the same edge that serves the request.
People’s own accounts at the investment-account platform (Alpaca), in their own names. Money moves account to account; Fotoh holds no money and has no custody of anyone’s. No card processor of Fotoh’s, no crypto rail, and no fees at the start.
Workers Analytics Engine for application-level metrics. Logpush to operator-owned storage. D1 audit_log table for every state transition.
TLS 1.3 only. Strict CSP. Origin keys never exposed to the client. Mutual TLS available for B2B partner integrations. Webhook signature verification end-to-end.
The platform is designed to pass audit, and the design is what is on this page. Every item below is specified and not yet built, and each one says so — an institutional partner reading a compliance list needs to know which controls exist today, and the honest answer is none of them.
Specified, not yet built: document + selfie liveness, address verification, government-ID validation, vendor-pluggable per tenant. Today the platform confirms an email and a phone, and nothing more.
Specified, not yet built: transaction monitoring rules, a SAR-ready audit trail, currency transaction report (CTR) workflows. No transaction is monitored today, because no money moves through a Fotoh account at all.
Specified, not yet built: SDN + non-SDN list checks at onboarding and at every payment leg, with a match-disposition workflow. No name has been screened against any list by this platform.
Specified, not yet built: decisioning that excludes protected-class signals, audit-logged decision trees, fair-lending review tooling. There is no decisioning surface yet, so there is nothing to audit.
The decisioning surface is specified, not built. No adverse-action notice is generated or sent by anything on this platform today, no bureau is queried, and no consumer dispute has been handled, because no credit decision has been made.
Specified, not yet built as tooling: subject-access, deletion, portability and consent workflows, with per-tenant data-residency controls. A request made today is answered by hand, and the privacy notice says where to send it.
There is no SOC 2 attestation, no audit under way and no auditor engaged. It is an intention, not a process, and calling it “in progress” would tell an institutional reader something that is not true.
For an operating nonprofit with related-party transactions: your own organisation's disclosure data, board-meeting packs and external-audit support, exportable from your tenant. The filing is your organisation's own; Fotoh, Inc. and Qardon issue no tax document.
Three doors: developer waitlist, partnership inquiry, or a direct conversation with the team.