Trust, shown.
Institutions ask for certifications. We are a young firm and we will earn those in time. Until then, and after, we do something rarer: we show you the actual proofs. Every claim below can be checked by your own engineer against your own room file.
The laws of the system
Your room is one file, encrypted in your browser with a key derived from your passphrase. We never see the passphrase, we hold no copy, and there is no recovery door for anyone, including us. This is arithmetic, and not a policy.
Check it · open your sealed file in a text editor: the ciphertext is on the page and no key is.The sealed file: nobody opens it but you. Your working answers: they reach us, your advisor, sealed in transit, and the room shows you on screen what travelled. Everyone else: never. Prefer us blind too? The Silent Room turns the sync off.
Check it · unplug the network: the room still opens and still computes.The standard instruments and the export are free forever, by law of the system. If we disappeared tomorrow, your room still opens, still computes, and still exports everything. We keep clients by being worth keeping.
Check it · run the export with the network off, and read the Continuity Covenant, which states what survives us.Every number the system produces can be recomputed from the formulas printed inside the room itself, and anyone who holds a Certificate can recompute it with the verifier that travels with it. Nothing that touches your numbers is a black box.
Check it · the checker inside your Room recomputes every close in your record from its formulas, in your own browser, offline.Every realised euro in your ledger is signed by a named person and sealed with a key generated in your own browser that never leaves your machine. A tampered line fails its own verification.
Check it · drop your record on the checker: it walks the seal chain quarter by quarter and names the first quarter whose seal no longer matches, with no call to us.How we prove it to ourselves
A battery of automated gates runs before anything moves. They boot a real room and attack it, and when one fails, nothing ships. We would rather say this than show a badge, because a badge is an audit of last year and a gate is an audit of this morning. Your security team may read the list and the results in person, line by line.
The server’s conduct
The server stores sealed files it cannot read, never writes over a client’s data, and serves a room only by its exact name. There is no analytics inside any room, no third-party script, no call to anyone but us. The evaluation terms and the server’s full conduct are a document we send on request before any evaluation starts.
The certificate, verified without us
A certificate is one object, issued by a company’s own room, carrying aggregates only: never a seat’s answer, never a score behind a number, never evidence text. Its schema and its verifier travel with it, so any recipient can verify one without us (what a certificate carries); a certificate a fund book cannot reproduce refuses to seat.
Our own record, kept the way we ask you to keep yours
This instrument asks a management team to write down what a move will be worth before making it, and then to keep the miss beside the hit for as long as they hold the company. It would be an odd thing to ask and not do. The same ledger is kept here, in public, and it opens honestly: it is empty of outcomes today. Predictions signed under mandate are the first entries, and the earliest cannot land until a quarter closes. A record that arrived pre-filled would tell you only that somebody wrote it backwards.
Every prediction we sign for a client, with the euro figure, the date and the quarter it is expected to land in. When that quarter closes the landed figure goes beside it and the difference is classified the same three ways the rooms use: execution gap, mispriced or external shock. Mispriced is the one that matters to you, because it is the only category that says our price was wrong and the world was fine.
Nothing is removed once entered, including the entries that would be more comfortable gone. A prediction that succeeded does not drop out for being old news, and one that missed does not get re-dated forward until it looks better. Both are how a track record becomes a brochure, and the second is written into our own engineering notes as a defect to guard against, because we made it once internally and caught it.
No client is named without a signature saying we may. The euro figures, the dates and the classifications stand on their own; a record that needs a logo to be believed is not a record.
First publication is due at the close of the first mandated quarter under the frozen model. Until then this section says what it will contain and shows nothing, which is the only honest state for a ledger with no closed quarters in it.
Whether a room stays a single file, decided
The room stays a single sealed file, and that is not provisional. What a client receives opens with no server, no account and no network, and it will keep working the day we are gone. A hosted fleet would learn from every room; a file learns from none; we chose the file, because the largest objection procurement has is the one the file removes.
The certifications, and their order
The assurance file above is what procurement reads today: the sealed-file mathematics, the laws of the system and the test gates run before anything ships, each one checkable on the file itself. ISO 27001 and SOC 2 follow in that order, sequenced on the fleet the first mandates build, and the date of each is set in writing with the client whose procurement needs it. Until then we walk your security team through the room file line by line, in person.
What the instruments are, by the moment you buy them, is on the offer map; where your data lives at each step is written there in one line each: the free instruments on your device, the paid ones on your own record.