More on trust and governance
The rest of how trust and governance work, one page each, past the first rows the sidebar shows.
Each page explains one part of how a Startup proves its Controls hold. Back to the group.
- Audit logAudit log keeps every Action with who took it, for whom, under which Mandate and with what result, append-only and hash-chained.
- The regulated perimeterWhat the platform builds at once, what goes Live only after a Credential or licensed upstream, and the money activities the platform never performs.
- Risk and continuityHow a Startup names what could go wrong, rehearses recovery, and keeps running when it does.
- Your dataWho owns the data in a Startup, where it lives, who can read it, how it leaves, and what erasure means when every record is kept forever.
- SubprocessorsEvery outside company that processes personal data for the platform and its Startups, what each does, and how changes are announced.
- Customer guaranteesWhat every Customer of every Startup is owed by construction, from an honest agent and a reachable person to online cancellation and a log of every access.
- Acceptable useWhat no Startup may build or do, how its agents must behave toward people, and how a violation is stopped and appealed.
- Answering a security reviewHow a Startup answers a security review from records it already keeps, with a trust page, live status, the scoped report, and sourced answers.
- AuditorsAn audit firm gets a scoped, read-only seat, tests the whole population by query, and signs one opinion that covers every Startup in scope.
- IntakesThe eight public addresses every Live Startup answers, from security reports to subpoenas, each with a deadline, an owning Role, and a Process.
- One Person, many StartupsFamily rules for sibling Startups that reach the same person, with one identity, one opt-out, one monthly limit on promotion, one Thread, and honest labels.