Claim ↔ Control
Every claim, an instrument.
Marketing claims do not stand on their own here. Each one is bound to a live control. If the control is not in place, the claim is removed.
Claim
Evidence-first
Live controls
- §SHA-256 digest computed in-browser at deposit (WebCrypto), prior to ciphering at rest.
- §Immutable version chain — every revision retains its prior_version_id and a fresh hash.
- §OpenTimestamps anchoring to the Bitcoin calendar pool; independently verifiable receipt.
Claim
Controlled access
Live controls
- §Role-based access control (super_admin · trustee_operator · compliance_officer · client_viewer).
- §Short-lived signed URLs (≤15 min TTL), issued only after server-side role / org / ownership check.
- §TOTP MFA required for super_admin, trustee_operator, and compliance_officer.
Claim
Institutional trust
Live controls
- §Cloudflare WAF + OWASP managed rules at the perimeter.
- §Per-route rate limiting on intake, login, signed-URL issuance, and hash verification.
- §Strict CSP, HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff on every response.
Claim
Auditable by default
Live controls
- §document_audit_log records every view, download, verify, role change, and signed-URL issuance.
- §Actor, IP, user agent, and UTC timestamp captured on each event.
- §Failed verification (hash mismatch) flags the artifact and writes an explicit audit entry.
Claim
Sovereign-grade readiness
Live controls
- §Documented operations runbook with restore drills and incident escalation.
- §Encrypted backups; periodic restore tests against a clean environment.
- §Cloudflare Turnstile bot mitigation on intake and login surfaces.
Claim
Confidential command
Live controls
- §Three-tier NDA classification (Engagement · Operating · Trustee Briefing) enforced at the access layer.
- §Classification stamped per artifact: Public · Internal · Confidential · Restricted · Sealed.
- §Path-blinded storage — clients never see internal storage paths or actor identifiers.
§ II
Posture in one sentence.
If a control is not implemented, the corresponding claim is removed from public marketing until it is. The full technical posture, accepted residual risk, and remediation cadence are maintained internally and disclosed under NDA to qualified counterparties.