Security
The boring parts, done.
Argon2 passwords. Email codes at sign-in. Optional Google Authenticator. httpOnly cookies on the parent domain.
Access
No session until the email is confirmed. Sessions die after six hours. Staff only see assigned clients unless they are a manager.
Money
Payouts sit pending until a person reviews them. Nothing silently leaves the ledger.