A control you do not check is a control you do not have.
32 controls protect every record here. Each one is a sentence that is either true or false right now, and each is re-checked by machine on a schedule — not written down once and assumed. This page is what the last check found.
31 holding · 1 not holding · 0 not decided · 0 not yet measured. Last check 2026-10-02 UTC.
| What is true when it holds | Now | Last checked (UTC) |
|---|---|---|
| Your data is separated from every other client's by the database itself, not by the software asking politely. | Holding | 2026-10-02 |
| Every place your data is stored is covered by the same separation rule — none was missed when something new shipped. | Holding | 2026-10-02 |
| The account the site uses has no way to look past the separation rule, and the site shuts that data off rather than guess. | Holding | 2026-10-01 |
| The record of what was decided, approved and produced still verifies from the first entry to the last. | Holding | 2026-10-02 |
| The statements behind every sealed answer are kept exactly as loaded, and each answer records which version of the calculation produced it and what it was computed from, so it can be re-run years later. | Holding | 2026-10-02 |
| A fingerprint of the whole record is published every day, outside the system, and today's continues yesterday's. | Holding | 2026-10-02 |
| Nobody signs off their own instruction. A second named person is required, and the record shows who. | Holding | 2026-10-02 |
| Once an entry is posted or a decision recorded, it cannot be edited or deleted. A correction is a new entry, and both are visible. | Holding | 2026-10-02 |
| A figure taken from a document is only used if it was found in that document, or a second person wrote down why they overrode it. | Holding | 2026-10-02 |
| Wire instructions change. A changed one is never acted on until someone has called a known number back and the call is on the record. | Holding | 2026-10-02 |
| The log of what happened can only be added to. Nothing in it can be quietly removed. | Holding | 2026-10-02 |
| The record of these checks is append-only and chained: any change after the fact would show, including one made by us. | Holding | 2026-10-02 |
| Signing in needs a verified address and a role an administrator granted. Nobody can promote themselves. | Holding | 2026-10-01 |
| A signed-in session is short-lived, and a request that did not come from our own pages cannot change anything. | Holding | 2026-10-01 |
| Access that was taken away stops working on the next request, everywhere, not only on the page it was taken from. | Holding | 2026-10-01 |
| Anything that changes something checks what the caller is allowed to do before it does it. | Not holding | 2026-10-01 |
| The few places that must look across families are named in one list, and nothing else can. | Holding | 2026-10-01 |
| Anything you upload is bounded before it is read, and nothing in a file we hand back can run when you open it. | Holding | 2026-09-26 |
| What a model reads from your documents cannot change anything by itself. A person decides, every time. | Holding | 2026-10-01 |
| The endpoints that cost money or send mail are rate limited across the whole service, not per server. | Holding | 2026-09-26 |
| A billing message is acted on only when it is signed and fresh, and never acted on twice. | Holding | 2026-09-26 |
| An adviser reaches your family only while you have granted them a seat. Withdrawing it takes effect immediately. | Holding | 2026-10-01 |
| Nothing ships until the whole automated suite has passed, including the checks on this page. | Holding | 2026-09-26 |
| No key or password of ours ever reaches your browser. | Holding | 2026-10-01 |
| Every log line passes through a filter that removes keys and passwords before it is written. | Holding | 2026-10-02 |
| Nothing we build on carries a known serious vulnerability. | Holding | 2026-10-01 |
| The site is reachable only over an encrypted connection, cannot be framed by another site, and pins where its code may come from. | Holding | 2026-10-02 |
| Recovering the platform database from backup is rehearsed every quarter, and the rehearsal is checked, not assumed. | Holding | 2026-09-26 |
| The account that ships changes can only ship changes. It cannot grant itself anything further. | Holding | 2026-09-20 |
| Every account needs a second factor to sign in. It is required, not offered. | Holding | 2026-09-26 |
| The checking itself is checked. If it stopped running, this page says so instead of leaving yesterday's answers looking like today's. | Holding | 2026-10-02 |
| The facts we cannot read from inside the service are fetched on a schedule, not remembered by a person. If one stops arriving, this page names it. | Holding | 2026-10-01 |
What this page is, and is not
Every row is checked against the running system, not against a document. Most are read straight from the database or the deployed code. A few — a dependency scan, the identity pool’s settings, the deploy account’s permissions, the last restore rehearsal — are captured by a named person and then machine-checked for content and for age. Evidence past its window reads “not decided” rather than passing quietly.
Each check writes one row to a ledger that can only be added to, and the ledger’s fingerprint is published every day outside the system. That is what makes this page evidence rather than a claim: a failing check cannot be deleted later, and a page that said “holding” on a day it was not would leave a hole anyone can see. A client, or its auditor, can ask us for the signed evidence pack for any date range and verify it themselves.
Audit status: no SOC 2 audit has begun, and no auditor is engaged. When one is, the auditor’s name and the date go on this line. What runs today is what an audit samples once a year, checked every day, with the record kept.
If we are not here
A client’s record cannot depend on a small company staying in business, so it does not. The book is the client’s to pull at any time without asking us: every table, as it stood on any date, with the hash of each version. Every assumption, entry, proof and decision exports as plain rows, and the ledger underneath is ordinary double-entry accounting that any accountant can read without our software. The daily fingerprint of the record is published outside the system, so a proof stays checkable whether or not we exist.