Trust by design
Every fact has a receipt.
Nothing is invented.
Why this page exists
Most AI tools ask you to trust the output. Vernais asks you to check it.
Every claim carries provenance. Every number returns its recipe. Every answer is the same tomorrow as it was today. Security isn't a settings tab we bolted on; it's the architecture the whole product is built from.
01 · Anti-hallucination
The anti-hallucination firewall
The graph stores only grounded facts. It never stores a conclusion.
Every node and edge in the Company Brain carries a receipt: the exact source span it came from, a confidence score, and which check passed to let it in. Nothing enters without one.
Facts in. Causality out.
"X caused Y" is never written to the graph. The data rarely says it literally, so we don't store it as if it did. Instead, causality is derived fresh at query time: the Investigator proposes it as an evidence-backed hypothesis, attaches the chain that supports it, and shows the counter-evidence. A hypothesis with a receipt, not a fact you can't check.
The closed-menu metric lock
When an investigation derives a Tracking metric, the AI can't invent one. It picks only from a closed menu of real events the field index actually discovered. The numerator and denominator sum grounded values only. Off-menu picks fall back to a deterministic, grounded default. The model chooses the metric; it cannot fabricate the math.
The confidence gate
Before an answer returns, an NLI (natural-language inference) gate checks the root-cause sentence against the retrieved evidence. If the causal claim isn't verbatim-entailed by the evidence, its confidence is capped at "medium." No wishful "high." No run-to-run flip between confident and unsure.
It says "I don't know"
Zero grounded evidence returns an honest "I have no evidence," not a plausible-sounding guess. Off-domain and nonsense questions get a refusal, not a fabrication. Name a single tool in your question and the investigation stays anchored to that tool: a GitHub 
question won't wander off to GitLab 
.
02 · Determinism
Determinism: same question, same answer
An AI that gives a different answer every time it's asked isn't an analyst. It's a slot machine. Vernais is engineered to be reproducible end-to-end. Ask the same question over the same data and you get the same answer.
Seed-locked jury
The node-jury runs at temperature 0 with a fixed seed on every vote. Byte-identical across runs.
Cached hypotheses, keyed to data
Preliminary hypotheses cache on the question plus a signature of the graph. New data changes the signature and regenerates; unchanged data reuses the exact same input.
Reproducible scores
The deterministic relevance scorer produces the same cosine, the same survivors, the same frontier.
Cached lookups
A repeated count returns the same recipe and the same number.
The route, the confidence, the primary hypothesis, and the survivor set are stable run to run. Only minor prose wording carries any variance.
The reasoning models are hosted; on rare, genuinely ambiguous turns a routing decision can flip. A per-conversation decision cache makes it deterministic within a conversation. We chose full-strength reasoning over hardcoded keyword rules, and were honest with ourselves about the trade-off.
03 · Data isolation
Isolation is a wall, not a filter.
Isolation in Vernais isn't a WHERE workspace_id = ? you have to remember to write everywhere. It's structural.
Every workspace is its own pair of databases
When a workspace is created, it gets its own knowledge-graph database and its own operational database, cloned blank from the schema, with no data and no cross-links to any other workspace.
- A Signal written in Workspace A does not exist in Workspace B.
- Memory, chat, initiatives, and the graph all live in the active workspace's own databases.
- A fresh workspace starts genuinely empty, verified, not assumed.
Membership is re-checked on every request
The active workspace is bound per request from your session. Every data request re-checks your current membership before it touches a database, so a revoked seat loses access immediately, not at next login. An authenticated user with no active workspace fails closed: data routes are refused, not quietly served from a shared default.
The one shared thing: Integrations
Connect a tool once and it shows connected across every workspace you belong to: the connection is shared, the data it syncs is not.
04 · Encryption & auth
Encryption & authentication
Security at the login, in the cookie, and at rest.
Passwords
- Passwords are hashed with Argon2id, the modern, memory-hard standard.
- A timing-equalizer runs on the user-not-found path, so login can't be used to probe which emails exist.
- Login and password-reset responses are generic, with no account enumeration.
Sessions
- A session is an opaque token in an HttpOnly, Secure, SameSite cookie, never readable by page scripts.
- The database stores only the SHA-256 hash of the token. A database read can't reconstruct a live session.
- Sessions are instantly revocable. Password reset or change revokes every active session.
At rest
- AES-256-GCM encrypts integration credentials and stored chat content.
- Reset and email-change tokens are single-use, time-boxed, and hashed at rest.
Google Sign-In
- OAuth 2.0 Authorization Code + PKCE with OIDC verification, hardened against code interception and token substitution.
Pre-production hardening (strict-mode cookies, reset tokens out of the URL, a shared-store rate limiter) is tracked and enabled for production deployments.
05 · Roles & permissions
Five roles, one editable matrix. Access is granted, not assumed.
| Role | members |
roles |
workspace |
billing |
integrations |
view |
export |
products |
investigations |
|---|---|---|---|---|---|---|---|---|---|
| Owner locked | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Admin | ✓ | ✓ | ✓ | ○ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Manager | ○ | ○ | ○ | ○ | ○ | ✓ | ✓ | ✓ | ✓ |
| Engineer | ○ | ○ | ○ | ○ | ○ | ✓ | ○ | ○ | ✓ |
| Viewer | ○ | ○ | ○ | ○ | ○ | ✓ | ○ | ○ | ○ |
Example default configuration: the Owner can toggle any role’s permissions, and the override persists per workspace.
The permission model is defined and Owner-manageable today. Per-feature enforcement of every key is the next layer. The model is the foundation it builds on.
06 · Compliance
Our posture, stated honestly.
We won't claim a certificate we don't hold. Here's exactly where we are.
SOC 2
Encryption in transit and at rest, per-workspace isolation, role-based access, and full audit trails.
GDPR & data handling
Per-workspace isolation, deletion flows, and audit trails support data-subject requests.
Data Processing Agreement
A DPA is available for your legal review on request.
Data residency
Single-region deployment today.
Subprocessors
A current list of the subprocessors we rely on.
Penetration testing
Internal adversarial review is continuous. Every major surface goes through a multi-agent security review before it ships.
These markers are honest placeholders, not claims. If you need a specific document, artifact, or timeline for your review, ask. We'll tell you exactly what exists today and what's scheduled.
The trust principles, in one place
Every number has a receipt. Here's the whole list.
Every number has a receipt
Exact filter recipe, the query, a sample of matched rows. No silent transforms.
Facts stored once
Causality is derived fresh at query time, never baked into the graph.
A closed-menu grounding lock
A metric can only pick from real, discovered events.
Confidence is honest and stable
The NLI gate caps unentailed causal claims at medium.
Same question, same answer
Seed-locked jury, cached hypotheses, reproducible scores.
It says "I don't know"
When there's no evidence.
Complete data isolation
A database pair per workspace, membership re-checked every call.
Encrypted where it matters
Argon2id, hashed opaque sessions, AES-256-GCM at rest, OIDC hardening.
Everything audited
Per-workspace activity log, separate immutable admin trail.