Stated plainly, including what is not built yet
This build is the production interface and the orchestration contract running on fictional demonstration data. The table below separates what the current environment enforces from what the next backend layer will enforce. A security page that blurs the two does not survive a first technical review.
Tenant isolation
Client workspaces are scoped at the application layer. No client can address another client workspace, and no output leaves the workspace it was produced in.
Per-tenant encryption keys and row-level isolation enforced at the storage layer.
Evidence custody
Origin, retrieval time and content hash are recorded at intake. Custody events append rather than overwrite.
Write-once evidence storage with hash chaining and independent verification of the chain.
Access control
Role separation between analyst and counsel. Counsel disposition fields are not writable by analyst roles.
Single sign-on, enforced multi-factor authentication, and per-case access lists with time-bounded grants.
Audit
Gate states, claim standards and dispositions carry an owner and a timestamp inside the case file.
Immutable audit log covering every read and write, exportable for client and regulator review.
Data sources
Public records and licensed market data only. No scraped private material, no purchased personal data, no material obtained in breach of a duty.
Per-source licence registry surfaced in the manifest with expiry tracking.
Retention
Stand-down records and refuted claims are retained deliberately, because the record of what failed supports what survived.
Client-configurable retention with legal hold, and certified deletion outside a hold.
The application is deployed on Vercel with immutable builds, per-deployment URLs and standard security headers set at the edge. No client evidence is stored in the demonstration environment.
Every issuer, sponsor, score, case and figure in this environment is invented. No entity here corresponds to a real company, fund or person, and nothing in it should be read as a statement about one.
Security questions and responsible disclosure go to the security contact named in the client engagement letter. A public contact address is published with the first production release.
See the radar run against your own credit book
A scoped pilot runs your obligor list through the four discovery layers for one quarter, with a named analyst and counsel review on every escalation.