Inspect the boundary.

Architecture and evidence

A Next.js service fronts PostgreSQL state, a deterministic policy engine and server-only Qloo calls. REST, MCP and A2A reuse the same authority services. Provider calls run outside database locks, then captured state is revalidated.

• Architecture and data boundaries
• Threat model and residual risks
• Dependency audit and SBOM
• Current execution evidence

Vendors and data

Vercel hosts the service; Neon stores application data; Qloo provides cultural evidence; optional Wikimedia media is presentation-only. OpenAI and Anthropic receive scoped tool data only when a user connects an assistant. Commercial Qloo rights, vendor-specific retention and signed data-processing agreements remain diligence items.

Deleting application records does not establish deletion from vendor backups or erase Qloo’s learned aggregate associations. No fixed recovery time, recovery point, uptime percentage or data-residency guarantee is claimed.

Buyer readiness

Ask for the architecture, authentication design, credential lifecycle, tenant-isolation tests, audit timeline, threat model and migration/recovery plan. Support is founder-operated. Enterprise contracting requires a defined operator identity, processing scope, retention schedule, liability terms and negotiated service expectations.

No SOC 2, ISO 27001, HIPAA approval, GDPR certification or legal compliance audit is represented. Start diligence →