Trust Contract
What we promise about your data, our sources, and who makes the decisions. Plain words, no badges we haven't earned.
How we earn confidence
Encrypt in transit and at rest
TLS everywhere; database and backups encrypted (provider KMS).
Secrets stay out of code
API keys and tokens live in env/vault only — never in git or the browser.
Read-only links first
Connected data starts as scoped, user-authorized, read-only. We don’t scrape your devices.
Decision support
We recommend deploy / hold / exit / flag / convert with citations. We do not auto-move capital or sign contracts.
Never write bookings
No writes to PMS / CRS / OTA guest systems.
What it is
- Capital Graph · Radars · Chat · Sound Asset Lodging for hotel investors and operators
- Every material number cited — or marked as an estimate
- Humans Approve / Edit / Dismiss — we never auto-execute
What we never do
- Auto-execute capital, debt, or franchise decisions
- Write to PMS / CRS / OTA booking systems
- Sell scraped outreach lists or spam from this product
- Put secrets in the client or the repo
- Pretend chat memory is a substitute for a connected graph
How we handle data
Public sources — always cited+−
CVB stats, filings, and press are treated as public; answers and Sound Asset Lodging memos still carry source labels.
Linked accounts — read-only defaults+−
When connectors ship: OAuth or user-controlled upload, least-privilege scopes, read-only until you explicitly widen them.
Encryption+−
TLS in transit; encryption at rest on the primary store and backups via cloud KMS. Standard, proven encryption — no proprietary crypto.
Access+−
Service roles are least-privilege; human access to production data is gated and logged as controls mature.
Retention / delete+−
Portfolio-private data follows a documented retention path once connectors ship.
Decision-support boundary+−
Model output is decision support. You ship judgment.
What's live today, and what comes next
- Live today: encrypted connections and storage, secrets kept out of code, and private sign-in for workspaces.
- Next: read-only links to your own data, which you authorize and can switch off.
- Later: an independent security review.
We only describe a safeguard here once it is actually in place.