Security: evidence before assurance.

The public demo is for guided evaluation using synthetic data. Do not upload confidential production records or rely on demo outputs for operational calibration. Customer deployments need their own security and acceptance review. See /readiness.

• Public website and lab pages were accessed over HTTPS. This is not an assessment of every endpoint or cipher configuration.
• An unauthenticated request to a client-record endpoint returned 401. This does not establish all permissions or tenant boundaries.
• A password-verified signature on a synthetic record passed its hash check. Independent performer/reviewer authorization and regulatory requirements remain unvalidated.
• Builds and selected regression tests passed; containers reported healthy at deployment. These are not load tests, vulnerability assessments or uptime guarantees.

Selected new entries verified, but ten historical entries still have verification mismatches. The overall history must not be described as fully verified, immutable or audit-validated. Historical records were retained, not silently rehashed to hide discrepancies.

• No independent penetration-test attestation, SOC 2 report or ISO 27001 certification is presented as verified.
• Storage-volume encryption, encrypted offsite backups, automatic retention and scheduled restore tests have not been verified in this readiness review.
• MFA, SSO, account recovery, organization isolation and independent reviewer permissions need dedicated testing.
• No complete claim is made for WAF coverage, threat-intelligence feeds, alert coverage, secret rotation, protected branches, signed commits or mandatory CI security scanning.
• Private, on-premise and air-gapped deployments require separate configuration and validation.

A pre-change database backup was created and its archive listing checked. A full restore was not rehearsed. No measured recovery-time or recovery-point objective is asserted. Encryption, offsite location, retention, restoration and operating responsibilities must be verified before production use.

Agree and test access control, record integrity, data handling, infrastructure security, recovery, monitoring and incident handling before operational use. Request deployment-specific evidence rather than treating a feature list as proof.

This factual status correction does not waive customer rights or reduce obligations in existing signed agreements, the Terms of Service or the Data Processing Agreement. Where those documents require safeguards not yet evidenced here, implementation and contractual review remain necessary. A contractual requirement is not proof of implementation.

Report suspected vulnerabilities to philip.montford@calbrixos.com with enough detail to reproduce the issue. Do not access other parties' data or degrade the service. Allow reasonable time for investigation before public disclosure. Good-faith security research conducted in accordance with this policy will not be subject to legal action by Montford Orbis. No fixed response or remediation time is represented as an established service level.

Safeguard credentials, assign appropriate permissions and use synthetic records during evaluation. Do not use unvalidated calculations, AI suggestions, dashboard statuses or demo certificates for safety or compliance decisions. Report suspected misuse or integrity concerns to the founder.