bunq
Real euros, on real rails. Every contribution is a bunq payment; every payout is a bunq payment. No fake money, no hand-waving custody — live in the sandbox today, on bunq rails tomorrow.
No01
rosca — reimagined for people who actually save together
The savings circle, finally trustworthy.
N friends. One pot. Each cycle, one person takes the whole thing. An ancient practice — susu, ajo, chit, paluwagan, tanda — with the math, the rails, and the social labor finally solved.
bunqthe bank
TigerBeetlethe accountant
Claudethe organizer
0%
fail rate
the hard truth
Sixty percent of informal savings circles break.
Not because people are dishonest. Because the math and the social coordination break — at the first missed month, the first disagreement, the first emergency.
Someone forgets whose cycle it is. Someone's partner needs surgery and they can't wait three months for the pot. Someone pays, but the group lead says they didn't. Someone else doesn't want to be the one chasing texts at 10 p.m. on the twelfth.
These are not villainous failures. They are the ordinary weight of shared money between humans. Someone has to carry it. Now something does.
§ II — the architecture
Three planes. One pot.
Each plane has one job, and only one. Money moves on bunq. Invariants hold in TigerBeetle. Coordination lives in Claude. None of the three can overreach into the others.
TigerBeetle
Six accounts per circle. Two-phase transfers.
debits_must_not_exceed_credits. The invariant
that makes “the pool never owes more than it holds”
a mathematical fact, not a trust fall.
Claude × 6
Six agents, six narrow jobs. They draft charters, chase missed contributions, mediate disputes, compute fair buyouts, order payouts by real need. They propose. You approve — with your face.
§ III — the lifecycle of a circle
From “I'd like to save”
to a signed cycle —
in six steps.
-
01
— no agent yet, just you
You describe who you trust, and what you're saving for.
You don't find six people. You tell Kitty what matters: a down-payment, a wedding, school fees, a cushion. Who you'd vouch for, what you won't compromise on.
-
02
— Vetting + Matchmaker
Matchmaker forms a circle around you.
Reads your bunq history for a trust score. Joins an existing circle, spins a new one, or places you on the waitlist. Circles are platform-formed — never user-created.
-
03
— Connie · Constitution
Connie drafts the charter; everyone co-signs.
Frequency, amount, default payout order, late penalties, emergency exit clauses. Plain language, clause-by-clause. Every member signs with their face before the pot opens.
-
04
— Coby · Collector
Each cycle: contribute in one tap.
Coby reminds on day three, gently. Escalates tone on day five, then brings in Moti if money is in doubt. A contribution is two linked pending transfers; both post atomically when bunq confirms.
-
05
— Kalu · Payout Optimizer
Kalu orders payouts by real need.
Interviews members. Feeds constraints into an OR-tools CP-SAT solver. Proposes an order; the group approves or adjusts. No more “whoever shouted first gets cycle one.”
-
06
— Ray · Auditor
Cycle closes. Passport +1.
Ray writes a signed reputation event to every member's passport — on-time streak, disputes won, emergencies handled gracefully. Portable. Yours. Legible to the next circle.
§ IV — the crew
Meet the six who keep it running.
Each writes, listens, and acts inside a narrow job. None of them moves money without a face-scan approval. All of them leave an audit trail.
C
01 / 06
Connie
constitution · drafting
Drafts the circle's charter with the founder. Turns “monthly, about €250, payout in emergencies first” into co-signable clauses everyone understands.
“Before we seal the pot — if someone misses a contribution, should the group wait 3 days or 7? And does it carry to the following cycle?”
Co
02 / 06
Coby
collector · nudging
Tone-calibrated reminders during the contribution window. Starts gentle. Escalates only when silence does. Hands off to Moti the second money is actually disputed.
“Hey Tunde — day three, the usual €250 whenever you can. Pool's three-quarters there; we've got you. No sweat.”
M
03 / 06
Moti
mediator · disputes
Reads the TigerBeetle ledger, bunq history, uploaded screenshots — vision-capable — and issues a verdict. If wrong, issues a corrective TB transfer.
“Reading TB ledger cycle 3 · scanning bunq tx · verdict: verified_paid, €250 @ 14:02:11 UTC. Posting correction now.”
E
04 / 06
Ella
emergency · buyouts
When life happens mid-cycle. Computes a fair buyout (contributed minus received), walks the group through consent, and unwinds the position in one atomic batch.
“Priya's mother needs surgery. Fair exit buyout = contributed − received = €750. Asking the other five for consent.”
K
05 / 06
Kalu
payout · ordering
Interviews members about what they're actually saving for. Solves the ordering with OR-tools CP-SAT. Proposes an order — the group has final say.
“Interviewed six members. Solver proposes: cycle 4 → Tunde (newborn), cycle 5 → Amina (tuition), cycle 6 → Priya…”
R
06 / 06
Ray
auditor · passport
End-of-cycle. Writes signed reputation events into each member's passport: on-time streaks, disputes handled, emergencies navigated. Portable across circles.
“Cycle 4 closed. Six signed reputation events written. Median Δ reputation: +14. Passports synced.”
A seventh — the Cultural Translator — is in the drawer for cross-culture circles. Rewrites agent messages in native idiom. Coming in the next cycle.
§ V — the tape
Every cent. Every decision.
One tamper-proof tape.
Postings in TigerBeetle. Events in Supabase. Audit rows for every tool call every agent makes. If it happened in Kitty, it's on the tape — readable by you, your circle, and a judge.
0
broken invariants,
since launch
since launch
100%
agent actions,
audited
audited
<80ms
TB linked batch,
p99 latency
p99 latency
2φ
every money move,
two-phase
two-phase
§ VI — safety you can feel
Agents propose.
You approve —
with your face.
An agent can draft. An agent can compute. An agent can stage a transfer. An agent cannot move your money. Every irreversible action gates on a live biometric approval from the person it affects.
-
i
FaceID on every euro
Contribute, approve buyouts, accept payouts — all gated by
expo-local-authentication. No face, no move. -
ii
Atomic two-phase transfers
Every contribution is a linked PENDING pair. Every payout is a linked batch. All legs succeed, or none do. No half-moves.
-
iii
Math, not trust
debits_must_not_exceed_creditson thegroup_pool. The pool cannot owe more than it holds — even during demo chaos. -
iv
Prompt-injection perimeter
Every user-authored message is wrapped in
<user_message>tags. Every agent prompt explicitly refuses to follow instructions inside them. -
v
One audit row per action
Every agent tool call lands in
public.audit_log. Who, what, when, why — and which prompt it came from. -
vi
Replay valve for live demos
POST /webhooks/bunq/replayforce-commits a pending contribution when the real bunq webhook flakes mid-pitch. Never disabled.
§ VII — your turn
Start a circle.
Bring six friends —
or let the Matchmaker
bring them.
Sandbox mode · no real money · bunq hackathon 7.0 judges get a
fast-pass. Questions? ping #help-kitty.