Software-proven
The most sensitive fields are sealed
SIN and banking details use sealed boxes bound to the tenant. This is software evidence; production key custody remains human-gated.
Trust, proof by proof
What the software proves. What it does not promise.
This page links each control to current repository evidence or an official source. It separates tested properties from commitments, partial work, and activations that remain human-held.
Inventory verified July 22, 2026
Three concrete actions
Plain words for a narrow scope.
The former labels become complete sentences. Each plate names the control, its limit, and its evidence.
Software-proven
The reason comes before opening
An actor, organization, and authorized purpose are required before decryption. If the audit event fails, the field stays closed.
Software-proven
The log can be verified
The audit log is append-only, anchored, and verifiable. Tests detect a privileged change inside an anchored range without claiming the system is perfect.
The seven invariants
Seven rules the software cannot silently bypass.
Each rule below is classified against current evidence. Software proof activates no real data, payment, or send.
-
Software-proven
Certificate after signature and settlement
The pipeline service refuses a certificate without signature or settlement evidence and creates the registry entry in the same transaction.
-
Software-proven
Client approval before any send
The send path requires approval by a CLIENT role. Provider operations staff cannot approve, send, or decrypt.
-
Software-proven
Generic product code stays separate from clients
CI rejects client-code imports from generic libraries and services, except at approved composition roots.
-
Software-proven
Money stays in integer cents
Amounts use 64-bit integer cents and half-even rounding. Floating-point values do not enter the money engine.
-
Software-proven
Audit precedes decryption
The only opening path requires a purpose and writes the audit event before attempting to decrypt sealed fields.
-
Software-proven
Synthetic mode is the default
PI_MODE defaults to synthetic_only. Any use of real personal information or mode change remains a separate human decision.
-
Software-proven
Fees never depend on funds raised
CI rejects any fee field or calculation that references the amount raised.
Program and human gates
Current status stays attached to every statement.
Isolation, MFA, accessibility, continuity, keys, real information, and public operations are not all at the same stage.
Software-proven
Measured per-organization isolation
Relations enrolled under FORCE RLS are covered by a battery that attempts cross-tenant reads and fails when a relation drops out of the inventory. This does not claim universal perfection or validation of a live deployment.
Partial, named scope
MFA required by session code
A first-factor-only token is refused. Locking production projects to named accounts remains an operator step before real use.
Partial, named scope
WCAG 2.2 AA remains a measured target
This page is tested by keyboard, at 390 px, with visible focus and axe analysis. That does not replace a full screen-by-screen audit of the platform.
Partial, named scope
Continuity documented, live exercise still open
On July 16, 2026, a synthetic backup, restore, and rollback exercise was recorded. It was not a recovery exercise on production infrastructure.
Human-gated
External penetration test not completed
As of July 22, 2026, the external engagement card remains open. This page announces no penetration-test result, finding, or attestation.
Human-gated
Production key custody not activated
Rotation code and responsibilities are documented. Real keys, owners, and vault operations are neither supplied nor activated by this page.
Human-gated
Real personal information behind the privacy gate
The demonstration uses synthetic tenants and people. Any real data requires a privacy decision, key configuration, and a separate human activation.
Human-gated
Sends, payments, portal, and tax production not activated
Gates A, B, and C remain human-held. Real payments, an active investor portal, automatic sends, and production tax-slip use are not available from this showcase.
Law 25 and incidents
Regulatory context explains the rigor without deciding for counsel.
Official context
Why the posture matters
Québec's access-to-information commission states that administrative monetary penalties can reach 10 million dollars or 2% of worldwide turnover. For certain penal offences, the law provides for up to 25 million dollars or 4%, whichever is greater. These figures are factual context, not counsel.
Commitment / roadmap
Runbook written, production watch not executed
The runbook covers detection, containment, assessment, notification, and recording. The 72-hour watch described by card #397 remains open and has not occurred.
What this page is not
An evidence map, not a seal.
- It declares no external-audit result and no certified compliance.
- It does not replace analysis by legal counsel or a security specialist.
- A screenshot, demonstration record, or green indicator never constitutes evidence on its own.
- Scope remains limited to the paths, tests, and runbooks linked on this page.
§ 06 · A question about the evidence
Let's discuss your context and the limits that matter.
Contact uses the shared Astrocytes house route, with no form on this page.