CLARITY / OSACT APPLIED
The controls built into the platform and the evidence still required before production.
Review draft · 18 October 2026 · Not yet approved for production
This build has not undergone a SOC 2 examination and does not claim HIPAA compliance, ISO 27001 certification or a completed independent security assessment. Provider certifications do not certify this platform. Production identity, storage, messaging, media and payments still require connection and acceptance.
Server-side client access checks, explicit owner permissions, bounded delegated-agent actions, version checks, exact approvals, idempotent operations and payment reconciliation are implemented. Private responses are not cached by the app. Payment and document access are checked server-side. These controls need deployment-specific review and operating evidence.
Files you upload are held in quarantine and never shown as uploaded. A sanitizer rebuilds a fresh copy from the parsed content: text is re-encoded as plain text, images are redrawn pixel by pixel without their metadata, and PDFs are rebuilt from their text layer without scripts, forms, links or attachments. Only that copy is shown, shared or delivered; the original is deleted after 7 days. Files that cannot be rebuilt stay in quarantine. This is not a virus scanner: files are rebuilt, not scanned.
Do not submit protected health information to this build. A healthcare deployment requires a documented risk analysis, appropriate safeguards, approved service boundaries and signed business associate agreements with the relevant parties and subprocessors. Health-record access must remain separate from commercial deliverable payment gates.
Verify identity and owner MFA, encryption and key management, production database isolation, backup restoration, retention/deletion, incident response, monitoring, access reviews, vendor contracts, abuse controls and an independent security test. SOC 2 additionally requires a defined system boundary and an examination by a qualified CPA firm.
Cloudflare is the intended hosting/identity environment. Stripe is the intended payment processor; the existing assistant provides messaging, and LiveKit has an implemented media adapter. These are planned integration boundaries, not an attested active subprocessor list. Product eligibility, regions, agreements and live data flows must be recorded before enabling each service.
Send a minimal description and affected public URL to do@not.rest with “Security report” in the subject. Do not email passwords, private customer records or exploit data. Ask for a secure transfer method if needed. No response-time guarantee or bug-bounty program is implied.
LET’S MAKE SOMETHING GOOD