Find answers in approved material
Search the active World and open the source version and exact region behind an answer.
Keep control of the knowledge your AI uses.
Turn approved manuals, contracts, policies and reports into a versioned World. Every answer can return to its source, and your reviewers control what becomes active.
What your team can do
Review what changed
Compare a candidate with the active World before a person decides whether it becomes available.
Take a verifiable result with you
Export a signed candidate package with its source inventory, provenance and validation record.
Follow one result back to its source
PUBLIC SAMPLE · SYNTHETIC DATA
page 1
What is the current full-service interval for FP-200?
Perform the full service procedure every 2,000 operating hours. This interval replaces the 1,500 hour interval published in revision B.
Source
A labeled sample page and source version.
Change
A candidate records what was added, changed or removed.
Approval
A person accepts or refuses the candidate; there is no silent activation.
Result
An answer opens its evidence, and a signed candidate package can be verified offline.
How it is run
Identity
Workspace access is authenticated and scoped to the workspace throughout protected operations.
Data handling
Sources enter a workspace-scoped intake boundary and are sanitized before downstream processing. Current processors are listed in the Trust Center.
Retention and deletion
Source material, derived artifacts and packages are deletable on request, with the deletion path described in the privacy notice.
Review records
Compile progress, review decisions, and relevant administration events can be included in the evidence agreed during scoping.
Deployment review
Before a pilot we walk through your sources, volumes, network path, retention needs and the security questions your team has to answer internally.
Support
A named contact through the pilot, with response expectations agreed in writing during scoping.
From scope to activation
Scope
Agree the decision to improve, the permitted source set and the supported intake path.
Evaluate
Compile approved material in a controlled pilot and keep unavailable states visible.
Measure
Review source evidence, changes, refusals and the agreed result measures together.
Activate
Contract and enable a customer workspace only after the evidence and control gates pass.
A pilot produces an agreed source inventory, reviewable candidate results, evidence-linked findings and a written go/no-go record. We agree the permitted inputs and named-contact support before any material is provided. Processing your own documents is arranged with us and is not enabled by purchasing a plan.
What a security review gets, and what it does not
Every row below is already stated on the page it links to; this is the same record in the order a security review asks for it. 10 in place · 1 on the roadmap · 8 absent.
| What a reviewer asks for | State | What is true today |
|---|---|---|
| Encryption in transit | Provided | Traffic is encrypted in transit throughout. Security |
| Encryption at rest | Provided | Stored objects are encrypted at rest by the storage provider, and service credentials remain on trusted server boundaries. Security |
| Workspace isolation | Provided | Identity and workspace membership are resolved server-side, and data access is scoped to the authenticated workspace and rechecked at protected operations. Security |
| Subprocessor record | Provided | Every third party permitted to process account, document, billing or inquiry data is named with its purpose, the data class and the region it is configured to process in. Thirty days' notice of an addition or replacement, with an objection right, is written into the processing addendum. Subprocessors |
| Personal data breach notification | Provided | Without undue delay and no later than 72 hours after becoming aware, with the nature and likely effects, the affected data categories, the measures taken or proposed and a contact point, and missing information supplied as it becomes available. Processing addendum (2026-09-30) |
| Deletion on a verified request | Provided | On a verified deletion request, or on termination, the scope and outcome are confirmed in writing, and compiled worlds can be exported as signed packages first. Affected material becomes eligible for physical purge 30 days after the verified request, and immutable artifacts carry a 28-day recovery protection from creation; these are configured periods, not a guaranteed completion deadline. A request may be limited or delayed by a legal hold or retention duty. Privacy notice |
| Restore drill | Provided | One drill is on record: on 2026-09-10 the production database was restored from its 2026-09-08 backup into a separate temporary project, the catalog of the original and the restored copy matched on all 431 objects, and the temporary project was deleted. It covered the database. It did not cover the document bytes in object storage, a full service recovery, or a run through the customer-facing application, and the receipt is available to a customer on request. Enterprise DPA template (archived draft) |
| Data processing terms | Provided | The 2026-09-30 processing addendum becomes part of the self-service agreement when a workspace owner explicitly accepts it, and the acceptance records the version and the hash of each document. It does not execute standard contractual clauses; a transfer that needs them is agreed before the affected data is submitted. Processing addendum (2026-09-30) |
| Responsible disclosure | Provided | The reporting address, the policy and the preferred languages are published at the standard well-known path. security.txt |
| Architecture, control evidence and questionnaire responses | Provided | Deployment-specific architecture, control evidence, assurance scope and questionnaire responses are provided through a qualified review rather than published here. Contact |
| Separately signed data processing agreement | Roadmap | Negotiated for an Enterprise engagement during scoping, starting from the archived 2026-09-23 draft, which is a template and not a signed agreement. No signed bilateral agreement exists until both parties execute one; once executed, it prevails within its scope. Enterprise DPA template (archived draft) |
| Customer-managed encryption keys | Not provided | Encryption at rest is the storage provider's. There is no customer-managed key. Processing addendum (2026-09-30) |
| Roles, single sign-on and a seat model | Not provided | Access control is a workspace membership checked server-side on every request. The account that owns a workspace is the account that reaches it, and source-level access is enforced at the grain of the workspace rather than the member. Enterprise DPA template (archived draft) |
| Contractual data residency | Not provided | The database and the serverless functions are configured for Seoul and the object bucket carries an Asia-Pacific location hint, which is best-effort. One processor (RunPod) has no pinned region. Subprocessors |
| A stated retention period | Not provided | Material stays until you delete it, until the workspace is deleted, or until a legal retention duty applies. No retention period is set: the 28-day recovery protection and the 30-day purge eligibility are deletion mechanics, not a retention period, and copies in provider backups age out under the provider's lifecycle. Privacy notice |
| Recovery point and recovery time objectives | Not provided | No recovery point objective, no recovery time objective and no backup retention period is committed in self-service. Objectives and a drill cadence can only come from a separately executed agreement. Processing addendum (2026-09-30) |
| Contractual uptime or resolution target | Not provided | Published plans include no contractual availability or resolution commitment. The published support target is an acknowledgement target rather than a resolution time, and Enterprise support terms are agreed during scoping. Pricing |
| Third-party assurance report | Not provided | No SOC 2 report, ISO 27001 certificate or independent penetration-test report exists yet. An external penetration test is planned after the first paying customer; SOC 2 timing is not set. The processing addendum's audit right is a real right to inspect controls, not a report that already exists. Processing addendum (2026-09-30) |
| Self-hosted, private-cloud or air-gapped installation | Not provided | There is one hosted deployment. No separate installation is offered on any scope. Pricing |
Review the maintained public record in the Trust Center and Security. Deployment-specific architecture, control evidence and questionnaire responses are provided during a qualified review. A self-service workspace is covered by the processing addendum its owner accepts with the self-service terms. An Enterprise engagement can negotiate a separately executed data processing agreement during scoping, starting from the archived 2026-09-23 template, which is a draft for review and not a signed agreement; once executed, it prevails within its scope.
What an engagement costs
The published plans and the per-page rate above them are on Pricing, in US dollars and excluding tax. An enterprise number is quoted after the deployment review, against your page volume, your source types and the work that connecting them takes — never before it, because every part of that quote depends on what the review finds.