Security & privacy
The controls, as they stand.
Every claim here maps to the code, gate, or committed document that makes it true, in an audit that publication depends on.
Where the model reads
The model is fenced in
Neither is the execution path. Running against a pinned version makes no model call, because that path cannot reach one.
The approval gate
Nothing ships without your approval
A drafted repair passes deterministic checks before you see it: the quarantined record has to conform under it, and the captured regression corpus has to keep passing. Only a proposal you approve becomes a pinned version.
Applying a repair without a human decision does not exist.
Quarantined records
A failed record is kept only as long as it is useful
That content is retained until its retention window passes, and then it is gone. What survives afterwards is the diagnosis — which rule failed, and where — with the values from your record removed.
Accounting
No silent drops
The run accounts for every source record it consumed: transformed, quarantined with its reason, or deliberately filtered. Losing data quietly is a defect, not a rounding error.
This website
What this site collects
Nothing here accepts so much as an email address. The design-partner page publishes an address to write to rather than operating a form, so anything you tell us you send from your own mail client.
Like any website, the network serving these pages processes basic request metadata to deliver them.
Whether the hosting platform's optional analytics beacon is switched on is a deployment setting confirmed at the legal gate before any traffic. Until it is confirmed off, we do not claim the served site carries no analytics at all.
The privacy policy and terms of use are published here, marked as drafts until counsel review clears them. They take effect, and the form opens, only after that review.
Every claim on this page is checked against the shipped product before it publishes, and this page changes when the product does.