Safety
The limits built into what we ship: what our software refuses to do, what the public key cannot reach, and what we do not claim. Our own conduct, not a questionnaire. We hold no security certification, and nothing here is an audit, an attestation or a claim to any standard.
What our software refuses to do
- Itô does not connect to bank accounts and never moves money. Those are not settings. There is nothing to switch on.
- Its numbers are arithmetic, not a model. No language model writes a figure a finance team reads, which is why we do not call it AI powered.
- An unknown is never shown as a zero. A blank that looks like a number is worse than a blank.
What the public key cannot reach
- It is public by design. Anyone can read it out of the page, so it is treated as though everybody has. Every table it can address carries row level security.
- It can write a contact submission and cannot read one back. No policy would let it. A response on an article is forced to pending by the database, not by the form, so a hand-crafted submission cannot publish itself; only approved responses are visible to the key.
- The operator area is not part of the public surface. Requests to it are turned away before any page is built, and a mutating request from another origin is refused rather than left to a cookie rule.
What we do when we find our own defect
One of our own migrations let an anonymous caller unsubscribe an address that had never subscribed, in a system where unsubscribing is permanent. We found it by testing against a real database rather than reading the code, and closed it in the next migration by removing the credential from the anonymous caller entirely. That migration refuses to finish if its own revocation did not take: a fix that can silently not apply is not a fix.
We write these down where the work is. A defect we introduced ourselves is better evidence of how we build than a list of controls.
What we do not claim
- A standard we have not been assessed against. We describe the controls that exist and say plainly where the answer is not yet.
- A client, a partner or an individual, without their written yes. A fact about a confidential engagement is not ours to publish.
- A deployment, a customer count or a result we cannot show. Where a product has not been used in the field, its own page says so, above the control that invites you to talk to us.
Telling us something
If you believe you have found a security problem in anything we run, tell us and say so. Describe what you found and leave it there: do not test it further, do not use anyone else's data, and give us a chance to fix it before you publish. We run no paid disclosure programme.