Work

This site is the evidence: Payload 3 and the Next.js App Router, type-safe from schema to deploy, with PostgreSQL on Neon and edge-served pages. Every collection, block, and component is built on the same stack you would receive.

You own the schema, the database, and the code outright. No black-box vendor lock-in — read the components before you hire us, and keep the whole record when the engagement ends.

The work above and below is authored through the exact CMS this site runs on — case studies are ordinary Payload records, not hand-coded pages.

The global economy leaks an estimated $36 trillion a year through the failures of 600-year-old double-entry accounting — fraud, corruption, reconciliation overhead, and identity silos. Pacio Core set out to build the missing primitive: an identity layer that makes every value transfer auditable by design.

SOS mints a self-sovereign identity from face and voice biometrics plus a single linked credential, weighted into a 0–100 veracity score. Banks and platforms verify age and identity through zero-knowledge APIs that return Boolean attestations — never raw personal data — against ISO/IEC 27566-1 and 30107-3 standards.

The MVP closed the loop with a real payment: USDC on Base Sepolia between two verified SIDs, producing an immutable Triple Entry record — payer, payee, and value in a single cryptographic receipt — with FATF Recommendations 10, 16, and 20 satisfied end to end.

The Caribbean taught us the pattern: regulators publish constantly across official gazettes, securities commissions, and central banks, and no tool on the market indexes them. The Gulf is the same regulatory black hole at six times the scale — SAMA, CBUAE, DFSA, QCB, the Central Bank of Bahrain, and the region’s capital-markets authorities.

The product is a curated, section-level regulatory corpus, assistive change monitoring of official sources, and AI-drafted regulatory guidance briefs where every material claim is bound to a stored section ID — anything unbound is flagged and never rendered. Monitoring is explicitly non-exhaustive and says so.

It ships multi-tenant from the first commit: role-based access, privileged client documents delivered only through short-lived signed URLs, and pinned model profiles with per-generation cost capture. Caribbean coverage first, then the GCC — briefs, not just monitoring.