- Nothing matches “”.
All reference pages
Reference
The mechanics, in detail
How the rules, the record, the isolation and the API actually work. Written for somebody checking this against a questionnaire, or building against it, rather than deciding whether to buy it.
Start here
Quickstart
Four ways in, ordered by how much they cost you. The first needs no account and takes ninety seconds.
Getting started
Arriving with no context, and the vocabulary the rest of this assumes.
What is the shortest path to seeing this catch something?
Four paths in, from pasting copy with no account to running the engine over HTTP, and what each one does and does not establish.
Quickstart →
What are the nouns, and which of them contains which?
Account, brand, campaign, post, rule, finding, override, release record — the words the rest of the reference uses without stopping to define them.
Concepts and vocabulary →
Rules
What a rule can express, what a result establishes, and who may change one.
Can this express the rules we already have?
All nine rule kinds, grouped by what code can settle about each, with the exact check behind every one.
The rule catalogue →
The report says no issues found — what does that actually mean?
Five states a rule can be in after a run, only one of which is a pass, and the arithmetic that keeps them from being collapsed into a percentage.
What a result establishes →
Who can change a rule, and in which direction?
Rules set at account, brand and campaign level travel downward. A level below can add and can tighten, and can never remove or weaken.
Rule inheritance →
Governance
What is written down when copy goes out, and when somebody disagrees with a finding.
What is written down when something goes out?
One record per release: what went out, which rules were in force, what each established, and who signed. Append-only.
The release record →
What happens when somebody disagrees with a finding?
Three things get called accepting a finding and they mean opposite things about the rule. Keeping them apart is what makes the ledger worth reading.
Overrides and set-asides →
API
Checking copy from wherever it is written, and what a key can and cannot reach.
Security
The material a supplier assessment asks for, in the form it asks for it.
How do you know one client cannot see another?
Isolation is enforced in the database rather than the application, and asserted rather than described. This is what the assertions ask.
Tenant isolation →
Where does our data sit, and what leaves it?
Residency, sub-processors, encryption, retention, headers and upload handling — written to be pasted into a supplier assessment.
Security and data handling →
The three facts that decide whether this passes a security review at all are on trust and security. The agreements are in legal. The arguments behind these mechanisms — why an approval expires, why a rule only travels one way — are in insights.