Every control on this page is tied to running code. Where something is a programme rather than a certificate, it is labelled as one, because a security page that overstates is the same failure as a model that overstates.
SOC 2 is a readiness programme for us, not a certificate. For your vendor-risk review we will answer your questionnaire directly and share the model documentation; where an answer is “not yet”, we will say that.
Four roles — admin, analyst, viewer and API-only — checked on every API request by the authentication middleware.
Signed, expiring session tokens; passwords stored as salted PBKDF2 hashes; repeated failed sign-ins from one source trigger a lockout.
TLS on every connection, and Google Cloud's default encryption for stored data.
Per-tier rate limits and monthly credit metering at the API layer, with structured request logging.
The served envelope carries a verification level (L0–L3) and a confidence cap for that level (0.30 to 0.95). The serving code takes the lower of the model's confidence and the cap.
Predictions are logged, but outcomes are not yet recorded, so the accuracy page publishes a dated validation record rather than a hit rate on resolved predictions.
Model cards for the validated models — methodology, data lineage, validation design and known limitations — written for SR 26-2 §VII vendor-model review. Available on request.
When our own re-validation finds a flaw, the claim is retired on the public accuracy page with a plain-language explanation.
For an analytics vendor the likeliest harm is not a breach — it is a confident number that turns out to have been leaking its own label. The controls against that are the ones published on the accuracy page, and they are enforced in the backend rather than in the copy.
| Control | How it is enforced | Status |
|---|---|---|
| Confidence caps | Confidence scores in the served envelope are capped by validation grade. 0.30 at L0, 0.50 at L1, 0.70 at L2, 0.95 at L3. The serving code takes the lower of the model's confidence and the cap. | SHIPS |
| Validation gates | A signal that has not passed validation is not promoted, and its badge says so — as it does today for the recession probability (L1 · Real · Unvalidated). | SHIPS |
| Refusal over estimation | Where a filing does not disclose what the private-credit score needs, the borrower is declined by name and the cell prints an em-dash instead of an estimate. | SHIPS |
| Retired-claims log | Public. Four withdrawals, each with the specific failure that caused it. | SHIPS |
| Outcome recording | Predictions are logged, but outcomes are not yet recorded, so no signal is graded on results in use. | NOT YET |
| SOC 2 report | A readiness programme, not a certificate. No auditor has issued an opinion. | NOT YET |
Two of the rows above say NOT YET. If your diligence needs either of them today, tell us on the first call and we will say so plainly.