CarryFrameAdmitted
One non-critical synthetic workflow. CarryFrame can record principal and token identifiers, roles, contexts, authority, obligations, raw record versions, reviews, in-path model/tool artifacts, timestamps and usage metadata.
Founding pilot / Security and data facts
Know the boundary
before you evaluate.
A factual summary of what the current synthetic pilot records, where it runs, how authority is checked and what remains unproven.
This page is not a security certification, audit opinion, data-processing agreement, legal advice, penetration-test report or production-readiness assurance.
Permitted data
Synthetic, non-sensitive and replaceable.
Not admitted
No personal or regulated records, credentials, secrets, production dependencies or irreplaceable information. This is contractual scope, not a content-classification guarantee.
Export handling
A signed export can contain the complete recorded workflow and must be protected as customer data. Verification does not make the contents public or harmless.
Identity and authority
Authentication does not imply permission.
Protected customer routes require a reviewed ZITADEL identity profile, explicit enrollment and current database-backed permission. A tenant key or caller-supplied actor string is not authentication. Human and machine principals are distinct; machine services use dedicated enrolled identities and restricted duties.
Tenant, role, context and administrative authority are checked at execution time and attributed to recorded actions. Scoped tenant-isolation and wrong-issuer/audience denials have passed acceptance checks. This is not a penetration test or independent security audit. Open signup and self-enrollment remain disabled.
Recording and integrity
Only the controlled path is visible.
Calls that bypass CarryFrame are invisible. The current admitted tool demonstration is one reference echo tool behind the qualified gateway path; broader tool coverage is not promised.
Events are ordered and predecessor-linked. The current Ed25519-signed export can be checked with a credential-free verifier and a separately trusted public-key fingerprint. That establishes integrity of the exported bytes and declared scope relative to the signer—not truth, completeness of outside activity, correct model/tool output, competent human oversight or an uncompromised signing key.
Current dependencies
The service path is disclosed.
API and data
Vercel hosts the public API and static site. The permanent Supabase/PostgreSQL store is in US West. The current pilot is not EU-only, zero-knowledge or customer-held-key.
Identity and tools
ZITADEL supplies the reviewed identity path. agentgateway runs on Railway for the one qualified reference tool. Manual recovery may be required after a tool-service crash.
Models and commerce
The public demo uses OpenRouter and its named demonstration model. The starter calls no model; pilot model spend needs separate approval. Stripe supplies one-off invoicing and SiteGround hosts enquiry email.
This operational list is not a complete legal subprocessor schedule. Contractual privacy roles depend on the customer's data and agreement; no DPA or transfer assessment is included.
Retention, deletion and exit
Disablement is not erasure.
Normal raw-record retention has a six-calendar-month floor. Supported raw history is not silently replaced by a summary. Cancellation and access disablement do not erase retained records.
Eligible scoped deletion requires authorised identity, a quiesced scope, a verified pre-deletion export, grace-period and archive checks, and leaves a tombstone. It is not immediate tenant-wide erasure and cannot recall customer-held exports, external-provider data or separately governed recovery copies.
At exit, stop execution, export and independently verify the final revision, transfer the export and separately authenticate its verification material, disable access, and agree responsibility for retained copies and later eligible deletion.
Operations and recovery
Scheduled support, no availability promise.
- No 24/7 cover, response-time commitment, availability guarantee, RPO or RTO.
- One internal test notification was delivered and acknowledged; continuous detection and customer notification are unproven.
- Application export/restore has been exercised into a disabled clone; whole-database disaster recovery has not.
- Incident procedure stops dispatch, preserves uncertain effects, avoids blind retries and restores only after reconciliation.
Not offered or established: SOC 2/ISO certification, penetration testing, a vulnerability-free system, customer-managed keys, EU-only residency, legal compliance, complete external-activity visibility, exactly-once external effects, production-critical suitability, continuous monitoring, independent time anchoring, universal provider support or an availability/recovery guarantee.
Before signing
Name the evidence your reviewer needs.
Agree the reviewer, synthetic workflow, exact facts, retention term, permitted identities, support contacts and technical acceptance test. Requests involving sensitive data, different residency, a DPA, additional tool/model routes, production dependencies or service commitments are outside the current offer.