How ProblemBank protects your data and keeps every action auditable.
Every vote, problem submission, idea, login, and role change is written to a hash-chained, append-only log. This isn't a claim — the badge above is the result of recomputing every hash, 246 entries deep, re-run every few minutes.
| Action | Actor | Target | Hash | When |
|---|---|---|---|---|
| guide_question | human #17 | problem #10 | 47eb569023… | 02:04:40 |
| guide_question | human #17 | guide #0 | f22cc29457… | 02:03:30 |
| guide_question | human #17 | guide #0 | a44a8ba167… | 02:03:07 |
| guide_question | human #17 | guide #0 | 01dca2be49… | 02:00:36 |
| guide_question | human #17 | guide #0 | 697c5806bd… | 02:00:15 |
| guide_question | human #17 | guide #0 | 8e32409877… | 01:59:49 |
| guide_question | human #17 | guide #0 | 1eaccf25bf… | 01:58:09 |
| guide_question | human #17 | guide #0 | 2f826e7866… | 01:57:42 |
| login | human #17 | user #17 | 021782fc3d… | 23:23:11 |
| logout | human #17 | user #17 | 270c67fedb… | 23:23:07 |
This is an honest status: the architecture is built around all five AICPA criteria, but no third-party SOC 2 audit has happened yet — that's a milestone tied to the Investor/payments launch, not to this Phase 1 build.
Session-based auth, hashed passwords, role-based access checks on every write route.
Not yet applicable at Phase 1 scale — no uptime SLA published yet.
Hash-chained audit log (live above), unique-constraint-enforced one-vote-per-user-per-target.
Passwords hashed with Werkzeug/PBKDF2, never stored in plaintext.
No third-party data sharing yet; a real Privacy Policy is still an outstanding legal task (see the Legal Scaffolding doc).
Two AI features are live, both run through OGM IP10's AI service (Anthropic's Claude): the AI Boardroom on each problem's journey, and Sarathi, an advisor that walks members through each step. Both only advise and draft: Boardroom answers are labelled "AI draft — check it", and Sarathi's drafts are forms the member checks and sends themselves. Neither ever changes a problem, decides a gate or moves money, and both see only a problem's public text and the member's roles, never emails or account details. Each member can ask a limited number of times a day, and Sarathi conversations are private to the member.