Trust and security

Controls are published without invented certifications.

The public trust layer covers intake, privacy, retention, access, AI use, incident reporting and known limitations.

Current controls

A practical control register

These descriptions are operational statements, not a substitute for a contract, audit report or independent certification.

The initial contact should contain only what is needed to assess the request.

Sensitive material is transferred only through an indicated channel and remains non-public.

Private applications use authenticated access and server-side persistence controls.

Hashes and action records support stability and traceability; they do not prove authorship or truth.

Retention and deletion depend on the service, contractual basis and any required hold.

Automated outputs are not treated as final decisions or autonomous forensic conclusions.

Security reporting

Do not include unrelated personal data or confidential evidence in an initial vulnerability report.