Trust and control evidence

Claims should carry their proof.

This page states what the current application controls do, where their limits are, and which repository evidence was reviewed. It is product evidence, not an independent audit report.

No certification is claimed. Govırn does not currently claim SOC 2, SOC 1, or ISO 27001 certification, audit, or attestation.

Reviewed assertions

Each material statement has a status, evidence, and review date.

PUBLIC-LEDGER-001

Implemented

Filed determinations are append-only, evidence-bound, hash-chained, and subject to human approval.

Evidence: supabase/migrations/h1_ledger_privileges.sql · supabase/migrations/20260958000000_evidence_bound_filing_v1.sql · supabase/migrations/20260959000000_human_signoff_ceremony_v1.sql · tests/rls/ledger-integrity.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-TENANT-001

Implemented

Organization access is enforced with database row-level security.

Evidence: scripts/security/rls-access-matrix.ts · tests/unit/tenant-matrix.test.ts · .github/workflows/rls-access-matrix.yml

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-VERIFY-001

Implemented

The exported chain package includes the records needed by Govırn’s database-free verifier to recompute content hashes, chain order, and the final ledger head.

Evidence: scripts/verify-export-package.ts · tests/unit/export-package-verifier.test.ts · tests/rls/chain-export-import.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-ANCHOR-001

Implemented with limits

External timestamp receipts are verified when they are present in the package.

Evidence: lib/verify-chain.ts · lib/anchor/providers/rfc3161.ts · tests/unit/export-package-verifier.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-VPC-001

Planned

this page does not represent a generally available service.

Evidence: DEPLOY.md · docs/DATA_FLOWS.md · app/api/vpc-waitlist/route.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-ANCHOR-002

Implemented with limits

Code and schedule describe a capability, not the operating status of a particular organization.

Evidence: .github/workflows/external-anchor.yml · scripts/security/anchor-chain-heads.ts · scripts/security/anchor-freshness.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-DATAFLOW-001

Implemented with limits

Enabled extraction and model workflows can send document bytes or document-derived text to the configured providers described in `docs/DATA_FLOWS.md`.

Evidence: docs/DATA_FLOWS.md · lib/extraction.ts · lib/model-provider.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-SECURITY-001

Implemented with limits

A chain is externally anchored only when its exported package or integrity response contains a valid receipt for the relevant head.

Evidence: app/api/integrity/verify/route.ts · scripts/verify-export-package.ts · tests/unit/export-package-verifier.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-WORKFLOW-001

Implemented

Answers, rationale, and selected evidence are captured in the session. Filing derives the completed path and freezes the evidence associations in one transaction.

Evidence: app/api/sessions/[id]/route.ts · app/api/sessions/[id]/file/route.ts · tests/rls/filing-gate-v1.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

PUBLIC-PACKAGE-001

Implemented

The filed record retains its framework and tree snapshot, effective answers, evidence associations, filing actor, and separate human approval history.

Evidence: supabase/migrations/20260961000000_filing_tree_snapshot.sql · app/api/export/chain/route.ts · app/determination/[id]/page.tsx · tests/integration/effective-answer-surfaces.test.ts

Reviewed: 2026-09-10
Review due: 2026-10-10

Hosted service boundary

Document handling depends on the selected workflow.

The hosted service uses Vercel for application delivery and Supabase for database, authentication, and file storage. When document extraction or model-assisted policy analysis is enabled, document bytes or document-derived text may be sent to the configured extraction and model providers. Those flows are documented before a pilot.

A customer-controlled AWS or Azure deployment is an early-access option under development. Availability and allowed outbound connections must be confirmed during technical scoping.

Ledger verification

Verify the package that exists.

The offline verifier recomputes exported content hashes, chain order, and the final ledger head without database access. It also verifies external timestamp receipts when the exported package contains them.

The presence of anchoring code does not prove a particular organization has a fresh receipt. Operational freshness must be established from that organization’s exported package and receipt status.