Every claim on this page traces to our technical due-diligence pack. Where a capability is partial or absent, it says so here rather than in a footnote you find later.
A reviewer will find these. Better that they come from us.
Unit coverage plus Playwright smoke and policy routing tests. Full live OAuth/SCIM/invoice journeys still need staging credentials in CI.
Plan: Wire remaining E2E journeys against a staging API with secrets — tracked in docs/testing.md.
QA process and release checklist now documented; named owner pending Medo confirmation.
Plan: Confirm named QA owner and enforce checklist on production PRs.
Sovereign routing and data-residency control exist today; installable software for your own perimeter does not.
Plan: See docs/on-prem-packaging-plan.md — containerisation and packaging, several weeks.
Controls are built and mapped. No audit has been completed and no report exists.
Plan: Engage an auditor. Timeline set by the audit window, not by engineering.
Named references and quantified outcomes are absent by choice rather than anonymised. We would rather show nothing than an unattributable quote.
Plan: Published as customers agree to be named.
Closed 6 August 2026: continuous integration runs build, typecheck and unit tests on every push and PR.
Microsoft Entra ID and Okta onboarding is connector configuration rather than bespoke integration.
| Capability | Endpoint | Status |
|---|---|---|
| Service discovery | GET /scim/v2/ServiceProviderConfig | Live |
| Schema discovery | GET /scim/v2/Schemas | Live |
| List / get users | GET /scim/v2/Users, /Users/{id} | Live |
| Create / replace / delete user | POST, PUT, DELETE /scim/v2/Users | Live |
| List / get groups | GET /scim/v2/Groups, /Groups/{id} | Live |
| Create / replace / delete group | POST, PUT, DELETE /scim/v2/Groups | Live |
| Per-tenant enable / disable | POST /api/v1/orgs/{org}/scim/{enable,disable} | Live |
Enforced before the call executes, not audited after.
All managed models allowed; frontier tier requires approval.
EU-friendly providers only. Approval required; frontier tier blocked.
Only local and customer-private endpoints may serve the request.
Free and standard models only, for development.
Next.js, exported as a static site. No server-side rendering in production, which removes a class of server attack surface.
Laravel (PHP 8.3/8.4) providing authentication, SCIM, governance, AI routing and the integration gateway.
TypeScript packages — model hub, provider hub, agent core, workflow engine, OCR, and the vertical applications.
Separate deployments (Invoice AI, Carbon, Sovra AI) federated through a server-side gateway.
Controls aligned
Ready — not certified
Controls aligned
Controls aligned
Controls aligned
“Aligned” means controls exist and are mapped; “certified” would mean an auditor has issued a report. We are the former.
We will walk your security and assurance team through any of the above, including the gaps.