Trust Center
The honest current state of this platform's controls - what is shipped and tested, what is planned, and the boundaries we will not cross. Nothing on this page claims more than the code and the control ledger actually do. Updated 2026-07-25.
What we will never do
No autonomous filings or submissions - export is never submission, and external status is recorded only from real receipts. · No shared government-portal credentials - your authorized person submits; we prepare. · No legal, chemical, or scope determinations by software - automation suggests, humans decide, and the gates enforcing that are deterministic code covered by tests. · No training AI models on your confidential data. · No silent schema remapping - an external template change opens a review case; it never rewrites your work. · No invented values - a field without a source document cannot be approved, full stop.
Control status (code-true)
| Control | Status | What it actually does |
|---|---|---|
| Tenant isolation | shipped | Row-tenant checks on every direct-object route, cross-tenant negative tests, workspace isolation self-checks (6 invariant families). |
| Authentication | shipped | Passwords: salted PBKDF2-SHA256 (600k, versioned). TOTP MFA, server-side session revocation, sign-out-everywhere, login rate limiting. |
| Evidence integrity | shipped | SHA-256 on every document; field-level provenance + structured fragment locators; completed versions hash-sealed and write-blocked at the database layer (tamper-evident). |
| Human-held judgment | shipped | Deterministic gates: no approval without a source document, contradictions block approval, exports never advance regulatory state, no legal/chemical conclusion is produced by software. |
| Encryption at rest | shipped | Object stores encrypted (AEAD when the cryptography backend is present; honest stdlib interim otherwise); key via environment, never in the repository. |
| Malware scanning | shipped | ClamAV verdict per document; infected/error fail closed; scanner absence is recorded honestly, never faked. |
| Audit trail | shipped | Append-only audit log (database-trigger enforced) on every consequential action, including reads of restricted PFAS records. |
| Retention & deletion | shipped | Conservative retention sweep (no schedule = never purges), legal holds, tenant data export, tested restore procedure. |
| PFAS restricted plane | shipped | Chemistry and trade-secret material live in a separate store with a separate role; negative boundary tests keep it that way. |
| WORM / storage-level retention lock | planned | Approved artifacts are application-write-blocked and hash-verified today (tamper-evident). True storage-level WORM lands with hosted object storage; until then we deliberately do not use the word 'immutable'. |
| E&O / cyber insurance | planned | Not yet carried. Founder decision 2026-07-22: bind coverage at first paid proof, before any regulated-data engagement that requires it. |
| SOC 2 | planned | Control baseline targets OWASP ASVS L2 / NIST SSDF now; formal SOC 2 only when buyer demand justifies it - no certification theater. |
"Tamper-evident" is deliberate language: approved artifacts are hash-sealed and write-blocked at the application and database layers, and every touch is audited - but until storage-level WORM retention lands, an infrastructure administrator is technically not physically prevented from destruction, so we do not say "immutable". Vendors who do are usually wrong.
Verification & evidence
Continuous verification
218+ automated tests across 16 suites run before and after every change: cross-tenant isolation attacks, permission negatives, gate bypass attempts, restricted-plane boundaries, restore drills, query-plan regressions. The suite is the contract - a control that regresses fails the build.
Ask us for
A redacted sample workpaper with its evidence manifest · the security questionnaire answered against this page · our data-processing addendum and subprocessor list (external AI processing is disclosed there, with a no-generative-AI workflow available) · the incident-response runbook summary · current insurance status in writing.
Service commitments
Intake acknowledgment and file manifest within one business day · critical missing-data notice within two business days of normalized intake · a frozen workpaper and its evidence packet retrievable within 24 hours · security-incident notification per contract. We commit to process and response - never to a regulatory outcome, supplier behavior, agency acceptance, or timeline we do not control.
Questions or a procurement packet request: use the contact on the main site. Client sign-in.