Trust pack

This page is an audit trail for review. It does not certify compliance, discharge COLP duties, or replace a DPIA. Facts below are either taken from SECURITY.md or marked Draft where they are not yet confirmed. No ISO, Cyber Essentials, or ICO number is claimed.

UK GDPR / DPIA stance Draft

V1 is approved only for synthetic demo data until the owner reviews M6 and a real-document evaluation set exists. A formal DPIA for live client data has not been completed. Do not point this deployment at real clients on the strength of this page.

Hosting location From SECURITY.md

Supabase is provisioned in London (eu-west-2). Vercel functions are pinned to lhr1. Storage paths are tenant-scoped. The same application is also served at disclosure.mindway.media as a Vercel alias.

No training on client data From SECURITY.md

Reducto and model-provider use must be configured for zero data retention. AI SDK telemetry sends neither prompts nor outputs. Application logs must contain IDs, rule codes, counts and error classes — not document content, client messages, emails, tokens or financial values.

Intended sub-processors Draft

This is the locked V1 stack, not a signed processor schedule. DPAs are owner-confirmed, not asserted here.

Vercel — application hosting, region lhr1
Supabase — database, auth and storage, eu-west-2
Trigger.dev — pipeline jobs
Reducto — extraction pass A, ZDR tier required
Anthropic and/or OpenAI — model inference, ZDR required
Braintrust — eval traces after redaction
Resend — transactional email in the stack list. V1 does not send client data by email; identity codes in this demo are shown to the firm.

Retention Draft

A numeric retention period for live client files has not been confirmed. Demo data is synthetic. Portal bearer tokens are hashed; a new link invalidates the previous token and expires after seven days.

Human-in-the-loop

Models propose. Deterministic TypeScript owns arithmetic and pass/fail. Two-pass disagreements go to the review queue. Flags are confirmed or dismissed by a person. The Chaser escalates legal questions and safeguarding immediately. Every such action is an append-only audit event.

04/01/2026, 09:00:00 · system · matter.opened
SYN-020 opened as a synthetic demonstration matter.
04/01/2026, 09:02:00 · system · portal.invited
Portal link issued. Link expires after seven days. Identity code required before the checklist opens.
04/01/2026, 10:12:00 · client · portal.identity
Identity check passed on the portal link (demo code, not a live email).
08/01/2026, 10:00:00 · system · extract.two_pass
Each uploaded financial document was read twice. Disagreement is held for a person.
bank-04.pdf p.1
08/01/2026, 10:08:00 · system · flag.raised
Candidate finding: payments to an account that is not in the disclosure bundle.
bank-04.pdf p.1
08/01/2026, 11:20:00 · reviewer · review.queue
Two-pass disagreements waiting in the review queue.
08/01/2026, 11:40:00 · fee-earner · flag.review
Finding left open for solicitor confirmation. No automated confirm or dismiss.

Download audit log (.json)