Everything that makes the decision hold, in one place.

One deployment, hosted in the European Union. Neither the database, the queue nor the object store publishes a port outward — reaching any of them means reaching the host first, and that is checked rather than declared.

Five years after the business relationship ends, counted from the end of the relationship and not from the day a document arrived. The number is our reading of AMLD art. 40 and reads as a floor rather than a period, so the policy file carries it as unconfirmed — and nothing is deleted automatically on a number in that state. The product shows what has expired; a person presses erase.

Erasure runs from an explicit list of tables that a test compares against the schema in both directions — a table added without a line in that list would survive a deletion the log calls complete. What stays is the audit minimum: the case keeps existing so that the record of the decision is not itself erased.

The log is append-only, so it used to be the one place personal data outlived its retention. It is now cut into segments, each closed by a signed anchor: a segment past its term is carried out of the chain, and the chain still verifies across the join. A carried-out segment is itself an entry in the log.

Signs the attestations that go on chain. It is held by the deployment and reaches one service only — the worker that publishes. It never enters a log, a trace, a queue or an error message, and a test keeps it out of the repository. Its public half is published, so anyone can check who signed without asking us for anything.

Signs the segment anchors of the audit log and the daily root. It is issued in this deployment: every published day names the key that sealed it, and that key’s public half is published beside the series. The demonstration file elsewhere on this site is drawn without a seal on purpose — it shows what a deployment holding no key shows, which is the state a product that cannot seal owes its reader.

Keys live in the deployment’s own secret store, held as masked, protected variables that are never issued to a build from an unprotected branch. A hardware-backed store, where the key never leaves and the application is handed a signing operation instead, is the next step and is not in place today.

The question an attestation has to answer is not “is this key current” but “was this address authorised at the moment of signing”, and that answer is published on chain under its own schema. Old public keys are kept for ever: a retired key that is dropped from the list turns its own signatures into somebody else’s. What a leak or a loss costs, and the order of the steps, is written down before either happens.

What the series has today is our own seal and a published daily root. Writing that root into a public chain is not in place: the mechanism runs end to end, but it runs against a test network, which carries no economic security and whose history can be discarded. We do not describe that as anchoring, because it is not the permanence a supervisor should count on. Moving the root to a chain that carries it is a decision not taken today; taking it would change the address written there and not who we are — the identity is the key, not the network.

The log publishes a daily root, so a copy taken once can be compared against every day after it. What the series does not carry yet is a third party’s statement of when: the field for an RFC 3161 timestamp is published as empty rather than left out, because an empty field you cannot see reads as time confirmed.

Sign-in by password or by Google. A second factor is available and, where the deployment carries no key for it, the profile screen says so in words instead of showing a factor that is not there. SAML and SCIM are not built.

Rights are enforced in the database rather than in the interface, a blocked control names the right that governs it, and the account that prepared a recommendation cannot approve it whatever its role. The full matrix is section 04.

Every action lands in your tenant’s own hash-chained log, including the ones that failed and the ones a right refused. Integrity is recomputed, never reported by a flag.

A break-glass procedure — a named grant from your administrator, time-boxed, written into your log as an entry you can read — is not built. Today administrative access to the pilot deployment is held by named people at Evix and is bounded by trust and by a written record of who those people are, which is a weaker control than a procedure and is described here as one.

Anthropic PBC receives whole document pages, the facts extracted from them and the text of a draft — the widest of the outward paths, and the only row a document reaches in full. Zero retention is switched on at the organisation level; that setting is the provider’s statement, and the register says so rather than presenting it as ours.

Company registries, the LEI foundation, name registries and issuer portals receive an identifier — a company number, a name, a domain, a document code. No document and no finding leaves towards them, and the difference between a source that is queried live and one that is read from a snapshot held here is derived from the code, not from prose.

Recognition and the object store run on our own host and are listed anyway, because “no answer” about your own node is itself an answer. Mail leaves to the relay the deployment names; error monitoring receives no subject data by construction.

No DPA, sub-processor annex or privacy notice exists yet, and none is claimed. They are issued with the pilot agreement. Until then this section is the register, not the contract.

No SOC 2 report, no ISO 27001 certificate, no audited attestation of any kind. No date is given for one either: a quarter named without a plan behind it is a promise, and a promise on a security page reads exactly like a claim.

The controls above are the kind an auditor can test rather than take on faith, and the product’s own output carries its proof: a sealed file verifies with a public key, against a public register, without our API, our DNS or our word. That is not a certificate, and it is not offered as one.

Recording a decision is offered to no program: the tool does not exist in any machine-facing surface, so it cannot be called by a misconfigured integration or an agent. The product’s default route scheme executes nothing on its own, and a configuration that would switch automatic approval on is refused as a file rather than ignored as a field.

A tenant may describe a route that executes without a hand. Where coverage is not closed, a screening alert is unresolved or a blocking limit stands open, the engine removes that possibility from the route whatever the scheme says — and the removal is not a setting anybody can turn off.

The model extracts, proposes and drafts. It never runs inside the coverage computation, and a proposal without a page, a character span and a quote is refused by the database rather than stored as a fact with a caveat.

Assessment in progress. We are not publishing a classification before the assessment behind it exists, and the honest interim answer is the one above: what the model does, what it is prevented from doing, and who signs.

The file leaves in a form that outlives the relationship: the decision record, the facts with their sources, the audit log and the seal. It verifies with a public key against a public register, so a file you took last year keeps answering for itself after you stop being a client and after we stop existing.

No published availability figure and no service credits. A number without a measurement behind it is the least useful sentence on a trust page, and an SLA is a contract clause rather than a page: it is issued with the pilot agreement.

The disclosure channel is published at /.well-known/security.txt in the form RFC 9116 defines, with an expiry that is recomputed on every deployment so the file cannot quietly go stale. A dedicated mailbox is not yet in place, and the file names the general address and says which one it is.

We acknowledge, we fix, and we tell you what we changed. There is no bounty programme and no legal safe-harbour text yet — both are named here as absent rather than implied by silence.