Trust

This page is the public envelope for security and privacy claims. It does not display SOC 2, ISO 27001, HIPAA, or a 99.6% accuracy badge, because those are not completed.

Currently true

• Public liveness is /health with status: ok and no dependency disclosure.
• Row-level security and Data API revokes are inventoried in repository migrations.
• Deletion and takedown process is documented on the privacy page (7-day ack, 30-day completion).
• The default verification path does not send test mail. SMTP RCPT TO is dual-gated (runtime flag and account opt-in).

Not claimed

• SOC 2 Type I/II and ISO 27001 are not in evidence. Do not treat this site as certified.
• HIPAA is out of scope. Do not send PHI.
• Accuracy is being revalidated against observed outcomes; there is no published percentage guarantee.

Security reports: use the contact form and start the message with “Security”. Privacy requests: start with “Privacy Request”.