Fewer, later, on purpose

The full payment architecture exists and is exercised in sandbox: hosted checkout, signed webhooks verified against the raw body through an idempotent inbox, a double-entry-style ledger in exact integer amounts, and refund approval with a second approver above a threshold. A provider activates per country only behind a signed readiness review with recorded evidence. No charge has ever been made.

SMS confirmations and reminders ride the same durable pipeline as email, with quiet hours, per-country approval, provider routing and a quota budget checked before every send. During the pilot every SMS gate is closed; the switches exist but the authority does not.

Transactional email only — confirmations, changes, reminders, one-time links. During the pilot, with no provider connected, email jobs dead-letter visibly with a recorded error instead of pretending to send, and operators can retry them the day a provider is connected. There is no marketing email anywhere in the product.

Venue booking QR codes and guest check-in passes are generated by DineGlobe itself — no third-party QR service processes your data. Check-in passes carry only an opaque secret; the system stores a hash, so a leaked database yields no usable passes.

POS connectors, review sites and reservation channels are deliberately out of scope for V1. An integration interface is not a working integration, and we will not list one before it is real.