How ProblemBank protects your data and keeps every action auditable.
Every vote, problem submission, idea, login, and role change is written to a hash-chained, append-only log. This isn't a claim — the badge above is a live result of recomputing every hash right now, 2 entries deep.
| Action | Actor | Target | Hash | When |
|---|---|---|---|---|
| password_reset_requested | human #1 | user #1 | 5fb3a86699… | 15:14:31 |
| seed_demo_data | human #1 | problem #1 | a8cb79f012… | 14:42:17 |
This is an honest status: the architecture is built around all five AICPA criteria, but no third-party SOC 2 audit has happened yet — that's a milestone tied to the Investor/payments launch, not to this Phase 1 build.
Session-based auth, hashed passwords, role-based access checks on every write route.
Not yet applicable at Phase 1 scale — no uptime SLA published yet.
Hash-chained audit log (live above), unique-constraint-enforced one-vote-per-user-per-target.
Passwords hashed with Werkzeug/PBKDF2, never stored in plaintext.
No third-party data sharing yet; a real Privacy Policy is still an outstanding legal task (see the Legal Scaffolding doc).
No AI features are live in this Phase 1 build yet — the Concierge page is a preview only, not wired to a live model. When AI features do ship, they follow the guardrails designed in the platform strategy docs: advisory and cited, never autonomous with money.