Security & trust

Clear controls for evidence your team can trust.

Every control below carries its actual status — shipped, armed at deploy, or planned. Shipped controls have code and tests behind them, so security review starts from a concrete record instead of a generic questionnaire.

Last reviewed 2026-09-04 · Reviewed on every release that changes a control · Questions: [email protected]

The operating model, in one paragraph

This is evidence software with client-held judgment. Your team, or the advisor you choose, makes every regulatory decision and holds every government credential. The platform makes the evidence behind those decisions traceable, reviewable and reproducible — what a source said, who concluded what, and which exact version supported what you sent out. The platform files nothing, certifies nothing, and renders no legal or chemical conclusion. That is not a limitation we are working around; it is the design, and the gates that enforce it are deterministic code covered by tests.

The one-line version for a procurement form: single-tenant-per-workspace row isolation with cross-tenant negative tests, SHA-256 provenance on every document, hash-sealed write-blocked record versions, append-only audit enforced at the database layer, TOTP MFA, encrypted object storage, fail-closed active-content screening, and no customer data in any AI training set, ever.

What we will never do

No autonomous filings or submissions. An export is a document you use. Generating one is never a submission, and external status is recorded only from a real receipt you give us.
No shared government-portal credentials. We do not ask for them, store them, or want them. Your authorized person submits; we prepare.
No legal, chemical, or scope determinations by software. Automation suggests; humans decide. A conclusion without a stated basis is refused by the code, not by policy.
No training AI models on your data. Not ours, not a vendor's. Optional model-assisted extraction is off by default, disclosed in the console when on, runs under commercial no-training terms, and only ever produces a suggestion a person must approve.
No silent schema remapping. When an external template changes, it opens a review case and exports fail closed. It never quietly rewrites your work.
No invented values. A field without a source document cannot be approved. There is no override, including for us.

Control status, code-true

Statuses mirror our internal control ledger exactly. SHIPPED means code enforced and covered by tests. ARMED AT DEPLOY means the code is shipped and a production setting switches it on. NOT BUILT means what it says.

Control	Status	What it actually does
Tenant isolation	SHIPPED	Row-tenant checks on every direct-object route, cross-tenant negative tests including refused writes, and workspace isolation self-checks across six invariant families run as a scripted exit-code gate.
Authentication	SHIPPED	Salted PBKDF2-SHA256 password hashing (600k iterations, versioned). TOTP MFA verified against the RFC 6238 test vectors. Per-account lockout after 5 failures in 15 minutes, with an identical failure message for wrong password, locked, and unknown accounts — no account existence oracle. Per-IP rate limiting keyed on the real visitor address.
Session handling	SHIPPED	HttpOnly, SameSite, signed cookies with a 12-hour horizon and sliding rotation. Server-side revocation: signing out kills copies of the cookie too, and sign-out-everywhere invalidates every session authenticated before the cutoff.
Staff MFA enforcement	ARMED AT DEPLOY	A platform toggle requires TOTP for all staff accounts and confines unenrolled staff to enrollment at next login. Switched on before any real-customer-data tenant.
Evidence integrity	SHIPPED	SHA-256 on every document, field-level provenance with structured fragment locators, and completed versions hash-sealed and write-blocked at the database layer. We call this tamper-evident, not immutable, and we will keep calling it that until storage-level retention lock is in place.
Human-held judgment	SHIPPED	Deterministic gates: no approval without a source document, contradictions block approval, exports never advance regulatory state, and no legal or chemical conclusion is produced by software. Machine approvals are labeled as machine approvals wherever they appear.
Encryption in transit	SHIPPED	TLS on every public hostname, provided at the hosting and edge layer.
Encryption at rest — documents	SHIPPED	Object stores encrypted with a vetted AEAD backend, key supplied from the host secret manager and never present in the repository. The backend used is recorded per file.
Encryption at rest — database	ARMED AT DEPLOY	Database files are not application-encrypted; they rely on host-level disk encryption from the hosting provider. We state this plainly rather than implying application-layer database encryption we have not written.
File-safety screening	SHIPPED	A bounded in-process active-content guard screens each supported upload before storage and records its verdict. Executable/type confusion, active or encrypted PDFs, unsafe Office content, and uninspectable or expansion-bomb containers reject fail closed. An external scanner is used only when separately configured and verified; we do not call the built-in guard antivirus.
Audit trail	SHIPPED	Append-only audit log enforced by database trigger on every consequential action, including reads of restricted records. Tenant-scoped access-log export, and the export is itself audited.
Retention & deletion	SHIPPED	Conservative retention sweep — no configured schedule means nothing is ever purged. Legal holds block deletion. Open-ended clocks are supported for records whose window does not close on a fixed date.
Backup & tested restore	SHIPPED	Nightly integrity-checked backups, plus an automated backup-destroy-restore-verify drill. The drill is not decorative: it caught and fixed a real restore-path bug.
Restricted plane (chemistry)	SHIPPED SYNTHETIC ONLY	Separate database and object directory, a dedicated role, and negative tests proving restricted chemistry never appears in the shared database, shared objects, or shared snapshots. This is app-layer separation validated on synthetic data. Real restricted data requires separate infrastructure and a named reviewer under a distinct engagement — it is not something you can switch on by signing up.
Application hardening	SHIPPED	CSRF tokens on every state-changing form, security headers, upload size ceilings, per-tenant rate limits on uploads and export builds.

Subprocessors

The complete list of third parties that can touch service data, and exactly what each one sees. If we add one, this list changes before the vendor does.

Subprocessor	Purpose	What it can see
Render	Application hosting and storage	Everything in the application at the infrastructure layer — the workspace database and encrypted object storage sit on their managed disk.
Cloudflare	DNS for both domains; hosting for the public marketing site	Marketing-site traffic only. Application hostnames resolve directly to the hosting provider and are not proxied, so workspace content does not transit Cloudflare.
Stripe	Hosted subscription checkout and optional-service invoices	Billing identity and payment details. Payment details are entered on Stripe's hosted page and never reach our servers. No workspace content is sent to Stripe.
Google Workspace	Business email	Correspondence you send us. Not workspace content, unless you email it to us — which is why we ask you not to.
Anthropic	Optional AI-assisted extraction — off by default	Only when an operator explicitly enables it, and only the document excerpts being extracted. Runs under commercial terms that prohibit training on the content. Disclosed in the console whenever it is on. If you would rather it never run at all, that is a setting, not a negotiation.
Transactional email provider	Account mail — welcome, password reset, account notices	Your email address and the account notice itself. Never workspace content, and never marketing or outreach mail.

Contracting, DPA, and your data rights

A DPA and data-authorization terms are available. The self-serve acceptance records the terms for the workspace and who remains responsible for verifying the output. Optional services use a separate agreement and scoped data authorization. We do not process real customer data without an applicable accepted set.
You own your data, on every account status. Complete workspace export works before an during a trial or subscription, during an optional engagement, and after either is cancelled. We deliberately never gate export behind billing — an evidence vendor that holds your evidence hostage is not an evidence vendor.
Deletion on request, subject to any legal hold you have asked us to honor.
No data selling, ever, and no use of your content for any purpose other than operating the service for you.
Insurance requirements are addressed in contracting, per engagement.
Incident response: we maintain a written runbook. If an incident affects your data you hear it from us, with what we know and when we knew it, not a sanitized note weeks later.

Current control roadmap

These items are stated as planned until the corresponding implementation and evidence exist.

We are not SOC 2 certified, and we are not currently in an audit window. We are an early-stage product and saying otherwise would be the exact kind of claim this whole platform exists to make impossible. What we have instead is the control ledger above, where every row is testable and most rows are backed by an automated test you could ask us to run in front of you. Our position: SOC 2 becomes worth its cost when a customer's procurement genuinely requires it, and we would rather tell you that plainly now than show you a badge-shaped promise.

Database files are not application-encrypted. They rely on host-level disk encryption. Application-layer database encryption arrives with the managed-database port.

Session cookies are signed, not encrypted. Their contents are non-secret identifiers and timestamps. Cookie theft is mitigated by short lifetime, rotation, server-side revocation and MFA — mitigated, not eliminated. That is an honest limit and we would rather write it down than let you assume otherwise.

The application runs as a single process with a file-backed database. That is correct and safe at pilot scale and wrong for heavy concurrent load. The port to a managed database is a planned piece of work, sequenced after real customers exist rather than before — it is a port, not a rescue.

Restricted-plane separation is validated at the application layer on synthetic data. Real restricted chemistry data requires separate infrastructure and a named qualified reviewer under a distinct engagement. It is available only through an expressly scoped engagement.

Ask us something specific

Send the actual question, or the actual security questionnaire. You will get a direct answer from a person who can read the code, including the answers that are “no, not yet.” If a control matters to you and does not exist, knowing that today is worth more to both of us than discovering it in month four.

[email protected]