Security · draft preview · no compliance claims
What exists now, and what must exist before real data.
This static preview has no product account or API. A separate synthetic app prototype exists in the repository but is not deployed here or accepted for real customer data; owner gates remain open.
In this build, today
| Area | Current state |
|---|---|
| Static pages | Seven prerendered pages. No product API, database or user accounts on this site. |
| Trackers and analytics | This site's code includes no analytics script, advertising pixel or third-party browser asset. |
| Cookies | None set by the site code; hosting-provider behavior needs separate review. |
| Data collection | No form or customer-record collection on these pages. The host still handles request metadata. |
| Product application | A synthetic local app prototype exists separately; real-data and release acceptance remain open. |
Planned before any real customer data
Some controls have local synthetic implementations, not hosted or real-data acceptance. Until all required layers are reviewed and tested, only synthetic data is used.
Identity and access
- Server-side identity verification on every request; membership and suspension read from current database state, not from stale token claims.
- Workspace isolation enforced by database row policies and composite tenant keys, with two-tenant negative tests — not by UI filtering alone.
- Role matrix where the technician surface reads and writes only assigned intake and custody events, and financial fields are structurally absent from field payloads.
- Owner and administrative security actions require fresh reauthentication.
- Support access denied by default; time-boxed, scoped, audited and revocable when granted.
Evidence and computation
- Uploads are quarantined and checked for byte signature, checksum, size and page or row limits before any parsing; a scanner outage leaves files quarantined.
- Photo location and unnecessary EXIF metadata are stripped before the first durable write; the sanitized file is labelled an evidence original, not the camera file.
- Extracted values keep raw text and a source pointer; missing, ambiguous, unsupported and unverified stay distinct from zero.
- Money uses decimal arithmetic and database numeric types; posted records are append-only and corrected through signed reversals.
- Every material mutation writes its audit event in the same transaction as the change.
Provider boundary
- Model use is disabled until approved credentials, endpoint, data-handling terms and per-tenant authorization are recorded.
- Extraction models receive delimited source text only; they have no tools, no network actions and no authority over money or decisions.
- A fake provider runs in development and tests; it never falls back to a live provider automatically.
- Document content is not used to improve cross-tenant models.
Operations and privacy
- Activation switches for ingestion, AI and exports default off and are auditable.
- Logs carry identifiers, stage timing and error codes — never document text, serial numbers, contact details or signed links.
- Privacy export, account removal and workspace deletion are separate operations with lineage-aware purging, backup-expiry tracking and restore tombstones.
- Pilot entitlements are granted manually with expiry, documented caps and audit events; no automatic charges.
What is explicitly not claimed
- No claim of SOC 2, ISO 27001, GDPR, DPDP, HIPAA, ITAR or any other compliance certification or audit.
- No claim that local tests equal hosted CI, staged acceptance or production readiness.
- No claim that a fake provider is a live integration.
- No claim that encrypted browser storage alone protects on-device drafts from a compromised or shared device.
- No public status page is promised with tenant-identifying content.
Where security evidence will live
Security findings, failed checks and unresolved defects are tracked in the project tracker with exact commit, command and environment evidence. No critical or high tenant-isolation or evidence-boundary defect may remain open before real-data use. The privacy draft covers data categories, rights and proposed retention.