Read the code, not the brochure.

Fails CI if the /demo path ever writes to durable storage — guarantees no demo invoice is kept.

Fails CI when the sub-processor list goes stale relative to its last-reviewed date.

Scans new dependencies for LLM, transformer, or AI packages on every pull request. Fails the build when one slips in.

The privacy-CI umbrella. Runs every privacy gate (no-LLM, sub-processor, demo-no-persistence, more) on every PR.

Encryption-at-rest encoding tests. Each ciphertext blob must round-trip exactly.

Recovery-key envelope encryption tests. Verifies the math we promise is the math we ship.

The golden tests. Every invoice fixture must extract to its committed expected output; any drift fails CI.

Cross-tenant isolation tests run against a live database. A failure here would block every release.

The Postgres row-level security migration. Each tenant only sees their own data at the database level.

The session-storage migration. How we keep you signed in without keeping anything we shouldn't.

The audit log route. Every change to your data leaves a record on this path.

The auth route — magic-link sign-in. No passwords, no SMS, no third-party identity providers.

The /v1/demo/extract API route, kept for internal tests. No persistence, no telemetry, no model training — read the code to confirm.

The demo-to-account handoff route. The only path your demo row can move to a real account is this one.

The data-export route. Pull everything we hold about you in machine-readable form.

The identity-key route. How we manage and rotate user identity keys without ever holding the private half.

The scheduled job that deletes demo extractions and expired audit rows after the retention window.

The /demo route. Renders the guided tour over hand-authored fixtures — no upload surface, no dropzone, no way for a cold visitor to send a real invoice.

The OCR preprocessing step. The exact pipeline that runs on every uploaded image before reading.

The GDPR Article 20 data-export playbook. How a customer pulls every byte we hold on them.

How long anonymous demo runs are kept and what triggers their deletion.

How the anonymous-to-signed-in handoff flow works end to end.

Our incident-response playbook. What we do, in what order, when something breaks.

How object storage is configured and the lifecycle rules that delete old uploads automatically.

The Data Processing Addendum — the legal terms we hold ourselves to when we touch customer data.

The PII scrubber tool. Strips identifying details from logs before any byte leaves the host.

The list of every third party we share any data with — what data, why, and where they store it.

The full threat model — what data exists, what could go wrong, and how each mitigation is enforced in code.