Designer identity protected. All actions logged. Independent QC required.

Identity is never exchanged

An order carries no identifying information about either party — not a name, not contact details, nothing that would let a client and designer identify each other. This isn't enforced by a policy someone could bypass; the underlying records for an order simply have nowhere to hold that information.

Communication happens through a message channel scoped to the order. Each participant sees the other only by role — "Client" or "Designer" — never by name. A participant can read the full conversation and still learn nothing about who they're talking to.

Every action is logged, permanently

Every state change on an order — submission, quoting, assignment, payment, QC decision, dispute, delivery — is written to an append-only record. Each entry is cryptographically chained to the one before it, so altering any past entry would break every entry after it. Existing records cannot be edited or deleted, by anyone, including the platform operator.

Independent QC is not optional

An order cannot reach delivery without passing through independent review by someone other than the designer who produced it. This is enforced the same way identity protection is: it is a required stage in the order's sequence, not a step that can be skipped or waived.

Access is scoped by default

Every party — client, designer, reviewer, staff — sees only what their role and relationship to a specific order permits. There is no broad internal view that exposes more than a role requires, and access defaults to denied unless explicitly granted.