Built like the evidence depends on it.
Sourcing runs on documents two companies would rather not show each other. The security model is written down in accepted architecture decisions — this page restates them in plain language, and nothing more.
The identity veil is structural
Supplier and buyer identities live in isolated PII tables with their own access rules — the veil is enforced where the data lives, not painted on in the interface. Reveal is a staged, audited state transition, never a one-shot toggle.
Evidence has no shareable URL
Evidence files are served through an authenticated same-origin proxy that verifies the committed bytes on the way out. No signed read URLs are minted for current evidence surfaces, so there is no link that keeps working after access is revoked.
Access is scoped and revocable
Workspaces have explicit ownership; collaborators get fixed permission bundles scoped to the resource, and revocation takes effect against live caches. Membership, resource parties, and service identities are separate primitives — never inferred from each other.
Declared before it can be written
Every state change in the workspace writes an audit event, and the fields each event may carry are declared in a generated, reviewable contract before the code can write it. The number on the right is computed from that contract at build time — it moves when the contract does, not when marketing does.
266
Audited event types
Append-only, with soft deletes — retention never rewrites history.
Three lines that never move
- SourceAgent never holds, transfers, escrows, or custodies buyer or supplier funds.
- Compliance and origin material is prepared for licensed-broker review — never issued as a determination.
- Identity reveal and any payment step are separate state transitions and are never coupled.
Questions about the model? Tell us about your project →