Audit log integrity

Chain verified ✓

Every vote, problem submission, idea, login, and role change is written to a hash-chained, append-only log. This isn't a claim — the badge above is a live result of recomputing every hash right now, 2 entries deep.

ActionActorTargetHashWhen
password_reset_requested human #1 user #1 5fb3a86699… 15:14:31
seed_demo_data human #1 problem #1 a8cb79f012… 14:42:17

SOC 2 — Trust Services Criteria (target, not yet audited)

This is an honest status: the architecture is built around all five AICPA criteria, but no third-party SOC 2 audit has happened yet — that's a milestone tied to the Investor/payments launch, not to this Phase 1 build.

Security

Session-based auth, hashed passwords, role-based access checks on every write route.

Availability

Not yet applicable at Phase 1 scale — no uptime SLA published yet.

Processing Integrity

Hash-chained audit log (live above), unique-constraint-enforced one-vote-per-user-per-target.

Confidentiality

Passwords hashed with Werkzeug/PBKDF2, never stored in plaintext.

Privacy

No third-party data sharing yet; a real Privacy Policy is still an outstanding legal task (see the Legal Scaffolding doc).

AI guardrails

No AI features are live in this Phase 1 build yet — the Concierge page is a preview only, not wired to a live model. When AI features do ship, they follow the guardrails designed in the platform strategy docs: advisory and cited, never autonomous with money.