Trust centre
If you cannot check our claims yourself, they are marketing.
This page exists so a diligence reader can disagree with us using our own material. It carries the regulation mapping, the isolation model, what happens when things fail — and, unedited, everything we have designed and not built.
What is not built
This is the complete list. It is the same list the pillar pages draw from, printed here without editing. If a sentence anywhere on this site seems to claim one of these as shipped, that sentence is wrong and this register governs.
DESIGNED, NOT BUILT
- The catastrophe financial chain — the exposure object, vulnerability and damage curves, deductible and limit application, exceedance-probability curves, and any stochastic event catalogue. What exists is peril physics and the analytics shell, not a catastrophe model.
- The dispatch seam between the orchestrator and the simulator. The simulator is deployed and the orchestrator is deployed; the executor that lets one drive the other does not yet do so.
- The formal-methods lane — the policy-wording compiler and the solver integration. The cross-model gate that backs it up IS built; the formal lane is not.
- Drift-detection logic. The alert taxonomy and the stores exist; the detection does not.
- A2A migration from the spec version our endpoint conforms to (v0.3.0) to the current one (v1.0.0), plus the party model, claim-state synchronisation and conflict surfacing.
- Tiers 3–5 of the dispatch ladder. Tiers 1 and 2 run in production.
- The folding-phone field client.
- The per-jurisdiction pack emitters.
- The lineage and context gates that enforce the inference boundary.
How the record maps to each regime
Mapping to an obligation is a different claim from having been assessed against it. We are making the first claim, not the second.
EU AI Act, Article 12shipped(shipped)
Automatic recording of events over the system’s lifetime.
The governed decision record is that log — not a copy of it, not a report derived from it.
EU AI Act, Article 14shipped(shipped)
Human oversight must be substantive, not nominal.
A named chair rules at a durable waitpoint, with reasons captured as a required field.
EU AI Act, Annex IIIdesigned(designed, not built)
Insurance risk assessment and pricing are high-risk.
Obligations have applied since 2 August 2026. We are not conformity-assessed and will not imply otherwise.
CJEU C-203/22 (SCHUFA line)designed(designed, not built)
The reasoning behind an automated decision must be explicable to the data subject.
The record compiles a per-subject rendering from the same thread the regulator reads.
GDPR Articles 9 and 22shipped(shipped)
Special-category data and automated decisions.
Psychometric and emotion inference never reach a risk decision — enforced in the platform.
Solvency II Article 124shipped(shipped)
Internal-model validation.
Reproducible seeded runs and logged expert judgement compile into the dossier.
DORAdesigned(designed, not built)
Operational resilience for financial entities.
Change to a rule, threshold, persona or model version is itself a gated, certificate-bearing record.
Isolation — three axes, or a refusal
Every read, write and dispatch is scoped on your organisation, the individual owner, and optionally the business unit. Anything personal — a mailbox, a harvest, a derived graph — stays private even inside one organisation. The predicate lives in the shared query layer that every repository inherits, not in something each route remembers to append. Identity is resolved from the authenticated request and nowhere else: no environment variable may translate it, and no tool or job may accept it as an argument.
When a surface cannot resolve all three axes, it does not guess and it does not fall back to a wider read. It refuses, with a machine code you can quote at us:
REFUSED
SCOPE_PREDICATE_MISSING
This view needs an organisation, a business unit and an owner. Only the organisation resolved, so nothing was read.
A partial predicate would have returned somebody else’s book. We render nothing rather than guess a scope.
That screen is on this page deliberately. Where the product fails closed we would rather show you the failure than describe the success.
Where your data lives, and whose keys run the AI
Residency
In our own European datacentre. Not a hyperscaler region, not a US-owned control plane. Evidence you cannot remove is evidence you do not own, so export is complete and in an open format, hashes included, so it stays checkable after it leaves us.
AI credentials
Your organisation’s own provider pool, your own billing. We hold no shared key behind your tenant. An organisation with no keys configured cannot serve AI at all — an honest empty state rather than a silent fallback to ours.
Analytics on this site is first-party and disclosed on the privacy page. A page arguing for evidence integrity may not ship third-party trackers that contradict its own privacy policy.