Trust

Your business deserves more than “trust us.”

If you hand someone your name, your customer relationships, and the way people find you, a reassuring sales pitch is not enough. We should show what this preview can do, what a release is allowed to change, and what can actually be put back.

Written for the owner deciding who gets close to the business.

What we can prove today

Four promises, each with its receipt.

These are facts about this development preview and the publication rules behind it. Each one names the check instead of asking you to believe the wording.

Your visitors are not followed around.

The three public marketing pages run no script and fetch their assets from this site, without an advertising or analytics widget. That is a claim about the pages, not a promise that hosting and security logs contain no request information.

How to check

Read the content-security-policy header on any page here: the script rule forbids scripts. Search the document for a script element and find none, then inspect the network requests and see that the page calls only this address.
The public marketing pages have nowhere to collect your details.

There is no form on the home, craft, or trust page, and each marketing display route refuses a submitted body before the application reads it. Bytes plainly reach the web server in order to be refused — we will not pretend otherwise — but those three renderers do not accept or persist them. The separate issued-account sign-in form posts directly to Cairn authentication; it is outside this marketing-page claim.

How to check

Send a body to any of the three public marketing pages. Each one returns 405 under its declared no-body rule, and the stored state remains unchanged.
A new power cannot hide inside an update.

A page cannot grant itself a power it was not given. A version that asks for new permission, or that would cost money to run, is refused before publication rather than discovered after it is live.

What this rules out

Before a version can go live, its list of powers and running cost are compared with what the owner accepted. This preview asks for neither. A changed version that reaches for an unlisted outside action or exceeds the approved limit is refused. The check covers power and cost; it does not claim that a person read every word.
Private drafts have a separate boundary.

The private workspace checks the signed-in account before letting it read or change a draft. Its private document bodies are sealed in storage. Publishing is a separate, deliberate release of the selected page content, not permission to expose the rest of an account.

Scope

Local tests exercise access from a second account and inspect the captured public pages for synthetic account and session markers. Those checks do not prove that all metadata is hidden from infrastructure operators, or that all retention and deletion questions are settled.

Recovery

Restore earlier content — with clear limits.

If a page change is wrong, the publication history lets you select earlier published content. That does not recall a message, reverse a payment, or undo an action that already left the system.

What restore covers

Earlier published content can be selected while its history remains available.
Local checks reproduce the earlier page bytes with the same renderer and assets.
The restoration is itself recorded instead of rewriting history silently.

What restore cannot cover

Anything already sent to a person or provider. Restoring a page cannot recall an action that already left the system.
Customer account credentials and private workspace state. Published-site restore does not restore either.
Work that was never handed over or retained. We can restore only a version the system actually holds.
An entire release across a changed renderer or asset set. The current content-restoration checks do not establish that broader guarantee.

If a future page says it can “undo” something that already left the system, treat the wording as a defect.

Still closed

What this preview cannot do for you yet.

Development preview means exactly that. These customer-facing features remain closed, and none of them opens just because a prettier page was published.

Public self-sign-up: Closed; The complete self-service journey is being built. Existing test accounts exercise sign-in and the workspace locally; a local result does not mean public registration or hosted access is open.
Payments: Closed; No amount shown here can be paid. Every price inside the three invented business previews belongs only to the demonstration.
Email or phone calls: Closed; Nothing in this product preview sends to or calls a real person, and no contact detail is requested.
Outside AI and other providers: Closed; No outside AI or other service is connected for a customer, and this page calls no third party while it loads.
Your own domain: Closed; Connecting your domain, changing its internet records, and sending it live remain separate reviewed operations.

Accountability

If the promise fails, the defect is ours.

A checkable page gives you a way to catch us. If a test here stops passing, the honest response is to correct the work and the claim in public — not explain away the difference.

See the design bench See what you keep

Your business deserves more than “trust us.”

Your visitors are not followed around.

The public marketing pages have nowhere to collect your details.

A new power cannot hide inside an update.

Private drafts have a separate boundary.

What restore covers

What restore cannot cover

If the promise fails, the defect is ours.