A platform built around its own refusals.
The most important thing about this platform is what it will not do. We are not in the business of broad reach. We are in the business of earning the trust of institutions with real responsibilities. Trust, for us, is operational. Below is what that looks like in practice.
We are not a data company
We do not sell access to data, license datasets, or run a marketplace. We are security practitioners who built the platform we wanted to use. Collection is lawful, proportionate, and minimised to each engagement's requirement — the platform exists to encode the discipline, not to monetise the inputs.
Vetting is manual, by design
Every requesting party is reviewed by a person — for who they are, the institution they represent, and the specific use case they bring. There is no self-serve sign-up, no automated tier, no instant API key. The friction is the feature: it is how we make sure the platform only ever works in defence of the organisations using it.
The process is slow on purpose
Onboarding takes time. References are taken. Use cases are reviewed carefully. We would rather lose a fast deal than ship the platform into a room where it would be misused. Speed is not a virtue when decisions carry real consequences for people and institutions.
One use case, one access
Vetting is per-organisation, per-use-case. Approval to use the platform for a stated purpose does not extend to a different purpose. If the work changes, so does the conversation.
Built for defensive use
The platform is built for defence — for understanding exposure, for due diligence, for protecting institutions and the people inside them. Offensive or unlawful use is declined at the vetting stage, before access is ever granted.
Not every request is approved
A meaningful percentage of approaches are declined — because the use case doesn't fit the platform's defensive purpose, because the institution is unfamiliar, or because the answer the requesting party wants is the answer that suits them rather than the one the evidence supports. Declining is part of the work, not an exception to it.
The platform follows its own rules
Every claim returns to its primary source. A finding is not promoted to a fact until two independent lenses agree. The brief that ships is the brief we can defend — to regulators and boards. The discipline is enforced inside the software, not just in our heads.
If a use case requires us to weaken any of the above, the answer is no — whatever the size of the opportunity, however established the institution, however tight the timeline. There is no version of this platform that bends on these.