EVIDENCE-BASED CONTROLS · TRANSPARENCY
Security & Engineering Specifications
We believe technical credibility comes from verifiable controls, automated verification, and factual disclosures—not unproven badges.
Data Handling & Privacy
- • No third-party advertising or marketing trackers
- • Dual-layer client and server PII sanitization
- • Ephemeral, non-persistent session identifiers
- • Strictly bounded payload size limits (<16KB)
Automated Verification Gates
- • Strict TypeScript compilation and zero-warning Biome checks
- • 26-pair WCAG 2.2 contrast validation in CI
- • Headless Chrome runtime assertions via CDP
- • Synthetic performance budgets on all interactive states
Telemetry & Observability
- • Self-hosted /api/telemetry ingestion endpoint
- • In-memory ring buffer with overflow protection
- • Server-side rate limiting to prevent abuse
- • Zero data exfiltration to external cloud analytics
Verification Evidence Matrix
Status of engineering controls across synthetic testing and operational stages.
Release Gate: Doctor 10/10
| Control Name | Category | Specification Details | Evidence State |
|---|---|---|---|
| Zero Third-Party Trackers | Data Privacy | Zero third-party marketing tags, advertising pixels, or invasive external analytics scripts in client bundles. | Automated (CI) |
| Client & Server PII Sanitization | Data Privacy | Deterministic allowlisting and redaction strips phone numbers, email addresses, and names before any telemetry ingestion. | Automated (CI) |
| Achromatic UI Invariants (ADR-0045) | Design System | Strict zero-chroma token enforcement across all components with zero visual drift between Light and Dark themes. | Automated (CI) |
| WCAG 2.2 Contrast Verification | Accessibility | Matrix runner tests 26 surface/foreground token pairs; all text meets AA (≥4.5:1) and primary text meets AAA (≥7:1). | Automated (CI) |
| Sub-200ms Synthetic Latency Budgets | Performance | Hard performance gates enforce <200ms interaction latency on modal transitions, theme toggles, and client computations. | Automated (CI) |
| Headless Chrome Runtime CDP Audit | Quality Assurance | 14 automated assertions verify computed styles, DOM rendering, and zero layout shift on live headless Chromium instances. | Runtime Verified |
| Self-Hosted Telemetry Ingestion (ADR-0046) | Observability | Telemetry dispatches directly to the internal /api/telemetry endpoint with bounded payload limits and rate limiting. | Implemented |
| Infrastructure Data Residency | Infrastructure | Targeted for in-region deployment; final data residency is governed by the deployed hosting tier and VPC configuration. | Deployment-Dependent |
| Production Real User Monitoring (RUM) | Observability | Live field metrics aggregation will be validated upon production deployment under Stage 3 operational certification. | Pending Field Certification |
Infrastructure Note
Telemetry Residency & Operational Deployment
Telemetry architecture is engineered to terminate strictly at the self-hosted /api/telemetry endpoint without passing through external CDNs or analytics aggregators. Production residency, log retention, and cloud compliance guarantees are governed by the deployment environment and hosting configuration established during client provisioning.