IR ↔ DE · M1

Exchange with a clear plan

A calm, evidence-backed path from an exact quote to a protected trade plan.

Exact totals Evidence-aware No real funds
SANDBOX · NO FUNDS

View sandbox quote

You pay
€50.00
Sandbox rate
€1 = 280,000 Toman
You receive
14,000,000 Toman
Sandbox fee€1.00Exact total€51.00
Quote lock04:59 · Sandbox
Why this offerBest exact rate
Available capacity€2,000.00
Payment routeSEPA Sandbox → Iranian bank Sandbox

Totals stay fixed for this quote. No live funds.

Sandbox only. No funds can move.

Iran · TomanProtected sandbox corridorGermany · EUR

Mini App trust boundary · RVA-037

Telegram entry becomes trusted only after server verification

Raw launch data crosses four explicit gates: cryptographic proof, a fresh timestamp, a single-use opaque intent, and a revocable device-bound session.

SANDBOX TELEGRAM ENTRYSERVER VERIFIED · BOT TOKEN OFF CLIENT
01 · RAWUntrusted launch payload
02 · HMACServer proof and freshness
03 · INTENTSingle-use opaque intent
04 · SESSIONDevice-bound session
HMACVALID
AUTH AGEFRESH
REPLAYCLEAR
DEVICEBOUND

initDataUnsafe, URL parameters, theme, platform, and client storage never authorize access. Sensitive actions still require the normal Rova step-up.

Transparent history · no score

History you can inspect

Separate facts reveal experience, concentration, timing, and disputes—never a hidden trust score or endorsement.

ILLUSTRATIVE SANDBOX HISTORY90-day example window
Completed exchanges124
Distinct counterparties68
Typical completion38 min · p95 92 min
Dispute context3 opened · 1 merchant-responsible
Largest counterparty share4.8%
Sample: 124 finalized Sandbox exchangesNo composite score

Illustrative Sandbox data only. Historical outcomes do not guarantee a future exchange.

A protocol, not a black box

Every step has one valid next move

The server checks who may act, the current version, and the exact agreement before it records a transition.

ILLUSTRATIVE SANDBOX PROTOCOLExample · aggregate v03
  1. Quote locked
  2. Two-sided acceptance
  3. Protected exchange
  4. Counterparty confirmation
  5. Final record

No skipped steps, silent edits, or duplicate commands. No real funds in this preview.

Exposure, deliberately bounded

One exchange. Three controlled slices.

The exact total is divided before execution. Every slice stays under current coverage, and only the next valid slice can become eligible.

ILLUSTRATIVE SANDBOX PLANEqualized · revision 01
Exact exchange total14,000,000 Toman
Current coverage ceiling5,000,000 Toman

Exact total conserved

  1. Slice 014,666,666 Toman

    Eligible now

  2. Slice 024,666,667 Toman

    Locked · fresh coverage required

  3. Slice 034,666,667 Toman

    Locked · fresh coverage required

Planning only: this does not reserve funds, contact a provider, or start a payment.

Private at the point of need

Nothing sensitive appears before its moment.

Instructions open only for the intended participant at the valid trade stage. Evidence stays quarantined until its exact hash and safety scan pass.

ILLUSTRATIVE PRIVACY HANDOFFMasked · no real details

ENCRYPTED INSTRUCTION ENVELOPE

Recipient details

Exact audience
Participant + active trade
Reveal proof
Purpose + step-up bound
Protected at rest
AES-256-GCM · opaque key ref

Checks aligned · reveal remains disabled in this preview

QUARANTINE-FIRST EVIDENCE

Proof enters safely

  1. Private quarantine
  2. Exact hash + scan
  3. Clean to share

Only clean evidence becomes eligible for purpose-bound access.

No names, bank details, documents, signed links, or decrypted content are shown here.

One timeline · server authority

A room that shows what the server knows.

Messages, declarations, confirmations, and deadlines share one ordered record. Realtime only tells the client when to refetch it.

ILLUSTRATIVE SANDBOX TRADE ROOMActive · room sequence 06
Server deadline16 Aug 2026 · 14:30 CEST
Supplementary countdown05:00 remaining
Last server clock14:25:00 CEST · synced

Authoritative timeline

  1. Trade room opened14:18:00 CEST
  2. Encrypted message delivered14:20:00 CEST
  3. Sent declared · not proof of settlement14:22:00 CEST
  4. Receipt confirmed by counterparty14:24:00 CEST

ENCRYPTED PARTICIPANT CHAT

Conversation stays bound to this trade

Instructions reviewed. No account details repeated here.

Sent declaration received. Verifying independently.

AES-256-GCM · participant-only access

Realtime hint receivedSequence 06 → refetch server snapshot
Declaration authority
Exact participant + MARK_PAYMENT_SENT step-up
Confirmation authority
Counterparty + CONFIRM_RECEIPT step-up

A countdown or realtime hint never confirms receipt, releases funds, or changes financial state.

Fair routing · explicit conflicts

The right case reaches an eligible human—not just the next human.

Level, certification, shift, capacity, and conflicts are checked first. Only then does a sealed weighted selection distribute the work.

ILLUSTRATIVE SUPPORT ROUTING LENSUrgent · support policy v01
First response SLA16 Aug 2026 · 14:15 CEST
Resolution SLA16 Aug 2026 · 16:00 CEST
Server observation14:04:00 CEST · on track

ELIGIBILITY GATES

04 / 04

  1. Support levelL2 meets L2 requirement
  2. Current certificationTrade room · IR↔DE
  3. Shift + capacityActive · 2 of 6 cases
  4. Conflict scanNo participant or prior-contributor match

SEALED WEIGHTED SELECTION

Eligible candidates share a verifiable draw

operator · 7A
operator · 2C
operator · 9F
Selectedoperator · 2C

candidate snapshot + policy + seed digest · audit sealed

Routing or SLA expiry never resolves a dispute, releases funds, changes a trade, or executes a decision.

Frozen progression · structured review

A dispute pauses the exchange before anyone decides the outcome.

Evidence stays purpose-bound, findings stay structured, and an appeal is reviewed by a different pair of supervisors.

ILLUSTRATIVE DISPUTE REVIEWOpen · progression frozen
Protective freezeTrade progression paused · no automatic release

REVIEW RECORD

04 / 04

  1. Dispute opened and bound
  2. Evidence requested with deadline
  3. Facts reviewed without PII exposure
  4. Remedy proposed · not executed
Evidence windowExact audience · clean references only
Initial decisionStructured findings · two-person quorum
Independent appealDifferent reviewers · one bounded window
reviewer · A4
+
reviewer · C9

Decision quorumTwo distinct current supervisors

Proposed remedy
Keep frozen · no execution authority
Appeal separation
No initial reviewer or contributor

A decision or appeal never moves funds, writes a ledger entry, calls a provider, or silently unfreezes the trade.

Readiness, without oversharing

Know what is checked—and why

Verification is a clear journey. Rova keeps evidence private, records its source, and never treats a provider callback as final proof.

Sandbox profile Ready for guided verification

  1. Identity evidence

    Authenticity, validity, and ownership are separate checks.

  2. Account ownership

    The payment account must match the verified participant.

  3. Capability decision

    A versioned policy grants only the capabilities supported by current checks.