Money moves. Your data doesn't.

Calmony DD runs on two regulated providers working in sequence. Modulr handles the BACS Direct Debit submission side: mandate creation (AUDDIS), collection scheduling, and the settlement file. Once funds settle, they move into a Griffin holding account where they are ringfenced per agent with a five BACS working-day clawback window before being swept to the agent's Griffin client account. Every money movement — collection, hold, release, forwarding, indemnity clawback — writes a paired double-entry ledger record so your statement always balances to the penny.

Returns and indemnity claims each trigger an automated workflow. For an ARUDD return, the system decodes the BACS reason code, marks the collection returned, recalls any held funds, notifies the agent by email and in-app notification, and — if the reason code is retry-eligible and your retry policy allows it — schedules a single re-submission for the next available BACS processing date. For an indemnity claim received via Modulr, the workflow records the claim, debits the holding account, and executes a Griffin transfer back to the originating payer. Claims above a configurable threshold are held for operator review before execution. Every step is visible in the Exceptions queue.

It is automated. A weekly scheduled workflow scans all active mandates where the most recent settled collection is more than 13 months ago — or where the mandate was activated more than 13 months ago and no collection has ever settled. Qualifying mandates are transitioned to expired status, any remaining scheduled collections are cancelled, a mandate.cancelled webhook is emitted to your connected systems, and the agent is notified. You do not need to track this manually.

A daily BACS reconciliation cron pulls the previous day's Modulr settlement file alongside Griffin holding-account transactions and matches each settled collection against its expected amount. Results are written to a reconciliation run record. Any unmatched item — under-collected, over-collected, missing, or unexpected — appears as an exception in the triage queue. A separate workflow fires at the end of each reconciliation run: for any agent with a mismatch count above zero, it sends that agent a summary email with the mismatch count and total value, creates exception triage rows for each mismatch, and escalates severity to high for missing or unexpected items. A separate daily double-entry integrity check also verifies that every debit in the ledger has a matching credit, and flags orphaned ledger entries.

Account numbers are encrypted at rest using AES-256-GCM via an application-level PII vault. The dashboard displays only the last four digits by default. The full account number is decrypted only when it is required for a Modulr submission, and every decryption operation writes an audit entry. Payer name and address fields are in the process of being migrated to the same encryption scheme — Phase 1 dual-write of encrypted columns is complete; the backfill and switchover to reading from the encrypted columns is the next step. Every domain table is also protected by Postgres row-level security policies keyed on organisation ID, so one agent's data is never accessible to another.

Calmony DD runs several automated detectors to catch exactly this. A daily cron checks for collections that have been in submitted or in_clearing status for more than four BACS working days and creates an exception triage record with a direct link to the affected collection. A separate daily sweep checks for holdings whose clawback window has passed but whose release workflow did not complete — it creates an exception record and attempts to restart the hold-release workflow. Mandates stuck in pending AUDDIS for more than five BACS working days are caught by the same mechanism. All of these surface in the Exceptions queue under your dashboard so an operator can investigate or retry with a single click.