Trust centre
Written for whoever
has to answer for it
You work in a market where trust is the asset and the record is permanent. This page is not reassurance — it is the set of commitments we expect to be held to, stated plainly enough to be checked.
- Isolated by default
- Fully accounted
- Yours to govern
First principles
Three commitments everything else follows from
Specific features change. These do not, because the rest of the design is derived from them.
Your work is yours alone
Your pursuits, your positions and your record belong to you. They are never pooled with other accounts and never used to inform anyone else's pursuit. Not anonymised, not aggregated — not used.
Separation is structural
Accounts are isolated at the foundation, not by a condition in a query. The protection does not depend on every future change remembering to apply a filter.
Nothing happens unobserved
Every action — by a person, by the operation, by an administrator — is written to a permanent record with its reasoning attached.
Isolation
Separated where it cannot be forgotten
There are two ways to keep one customer's data away from another's. One is to remember to filter every query. The other is to make unfiltered access structurally impossible. We do the second, because the first is one oversight away from an incident.
- Separation enforced beneath the application, not inside it
- A request cannot reach another account's work even if the code asks wrongly
- Privileged operations are narrow, deliberate and individually recorded
- Elevated access is scoped to a purpose and revocable immediately
Governance
You decide how much it decides
Autonomy is not a property of the product. It is a setting you hold, with a range wide enough to suit a firm that wants everything reviewed and a firm that wants to be told afterwards.
Oversight modes
Per frontReview
Nothing advances without a person approving it.
Assisted
Prepared completely; a person authorises the filing.
Autonomous
Runs inside your boundaries and reports what it did.
Changeable at any moment. No mode is a one-way door, and nothing requires a conversation with us to adjust.
- 01
Boundaries are yours to draw
Where it may compete, what it must never touch, the value range it may commit you to, the pace it may work at.
- 02
Thresholds are yours to set
The standard a response must clear before it may be filed. Below your bar, it does not go out — the deadline is not an argument.
- 03
A stop is immediate
One control halts the operation. Nothing further is committed in your name from that moment.
- 04
Exceptions always surface
Whatever mode you choose, anything outside the boundaries you drew comes to a person rather than being resolved quietly.
Accountability
A record you can hand over unprepared
The test of an audit trail is whether you can give it to a reviewer without spending two days assembling it first. Every action is recorded as it happens, in a form meant to be read by someone who was not there.
- Who acted, what changed, when, and on what basis
- Decisions carry their reasoning, not just their result
- Administrative actions recorded to the same standard as everything else
- Readable, filterable and exportable without preparation
Data
Where it lives and what becomes of it
Plain answers, because the question is always asked and vagueness is the wrong response to it.
Encrypted and sealed
Stored encrypted. Credentials for anything you connect are sealed separately and never held in readable form.
Encrypted throughout
Every connection is encrypted end to end. There is no unencrypted path, internal or external.
Yours to take
Export everything at any time, in full. Your record is not leverage and will never be treated as such.
Actually deleted
Ask and it goes, on a stated timeline, with written confirmation of what was removed.
Continuity
Deadlines do not reschedule themselves
In most software an outage is an inconvenience. Here it is a closing date that passed. Continuity is therefore treated as a correctness requirement rather than an availability target.
Deadline-aware by design
Work is sequenced against closing dates, so an interruption does not silently consume the margin you were relying on.
Interrupted work resumes
A pursuit in progress picks up where it stopped rather than restarting or quietly vanishing.
Failures are loud
If something cannot be completed you are told, specifically, while there is still time to act. Silence is never a status.
Degradation is partial
A problem in one part of the operation does not stop the rest. Fronts are independent, and so are their failures.
Shared between accounts
Not pooled, not aggregated.
Permanently recorded
Including administrative.
Full export
Your record, your copy.
Stop control
Nothing further committed.
Questions
What reviewers ask
Is our work used to improve the product for others?
No. Your pursuits, positions and record are used to serve your account and nothing else. They are not used as training material, not aggregated into benchmarks, and not shared in any form with another account.
Who at your end can see our data?
Access is limited to what is required to operate the service, scoped to a purpose, time-bounded, and recorded in the same trail you can read. There is no standing, unrecorded access to customer work.
What happens if we stop using it?
You export everything first — in full, in a usable form. Then you ask for deletion and we confirm in writing what was removed and when.
Can we restrict what it is allowed to commit us to?
Yes, and we recommend it. Set the value range, the buyers, the work types and the oversight mode. Anything outside those boundaries comes to a person instead of proceeding.
How do we verify any of this rather than take your word?
Read the trail — it is yours, complete, and not curated for you. Ask for the security documentation your review requires. And test the stop control yourself: it is one action and it takes effect immediately.
We would rather be held to a commitment stated plainly than be praised for one written vaguely enough to escape.
Bring your security review
Send the questionnaire your process requires. We would rather answer it properly at the start than be asked to explain something later.