Trust
Numbers you can put in front of your customer
You are going to hand these figures to someone who may check them. So the platform follows one rule: a number it cannot justify is not shown, and every number it does show records what established it. This page follows the same rule — each claim below names the mechanism that enforces it.
How to read this page
Three commitments before any feature list
A trust page is a claims exercise. These are the rules ours follows.
A figure arrives with its provenance
Every derived number knows what established it. A distance taken from a plan calibrated against a drawn reference line is not treated as equal to one taken from a scale nobody ever set — and the difference is recorded rather than averaged away.
Controls are built to fail loudly
A check that cannot fail is worse than no check, because it buys confidence without earning it. Where we had the choice between a mechanism that silently corrects and a test that proves, we chose the one that can go red.
The claims are gated, not merely written
The prices, the capabilities overview, and the retired phrasings on this site are checked by scripts that break the build. Copy cannot quietly drift away from the product, because a page that disagrees with the code fails to ship.
Measurement integrity
The product declines to record what it cannot justify
Set a plan scale and the studio measures in feet. Skip it, and the measure tool will not save the measurement — it tells you to calibrate first. This matters because an uncalibrated plan does not arrive blank: a default scale is stamped when the plan is saved, so a positive number is no proof that anyone ever set it. The check therefore asks for provenance, not for a number greater than zero.
- Eight ways to establish scale — a drawn reference line, a known object, the scale notation printed on the sheet, CAD units, a satellite overlay, an auto-detected blueprint scale, a declared value, or a grid
- Which one was used is stored with the plan, so a later reader can tell a real scale from an assumed one
- Derived areas inherit that confidence rather than a flat rating: a printed scale notation is scored as estimated, because a printed scale is weaker evidence than a line someone drew against a known length
- Plans already aligned to the map are recognised as calibrated, so honest existing work is never refused for lacking a newer provenance stamp
What the check asks
- Question
- who established this scale?
- Not
- is pixels-per-foot greater than zero?
- If unknown
- refuse, and say why
- Recorded
- the method, with the plan
Evidence
Signed records, built to be re-verified (e-signature coming soon)
E-signature is coming soon, so no agreement completes in the product yet. As built, when an agreement completes, its certificate pins hashes of the signed record. Those hashes are not ornamental: a verification endpoint recomputes them from the agreement at the versions the certificate stamped, and returns a verdict per plane. Anyone entitled to see the record will be able to prove that it has not been altered since issuance.
- Hashes are recomputed from the source, not compared against a stored copy of themselves
- The verdict is per plane, so a mismatch names what changed instead of failing vaguely
- Verification is tenancy-scoped — a caller can only verify a certificate belonging to their own organization
- Audit logs and device ledgers are append-only, with update and delete denied at the database rule layer
The evidence spine
- Pinned
- hashes at stamped versions
- Recomputed
- from the agreement itself
- Verdict
- per plane, on demand
- Ledgers
- append-only by rule
Design choice
A detector that proves, instead of a filter that might
Customer-facing documents must carry nothing internal. The obvious build is a redactor that strips internal language on the way out. We built a detector that fails the export instead, and the reasoning is written into the module: a redactor that runs and removes nothing looks like a control while controlling nothing. A test that proves nothing leaked cannot fail open. A mechanism that silently removes things can.
- The export fails loudly on a leak rather than quietly repairing it
- A pattern list that matches nothing is visible as a passing test, not invisible as a no-op
- The same reasoning is why the scale check refuses rather than substituting a plausible default
This site
The page you are reading is under the same rules
Marketing copy drifts from a product by default, because the page is not edited when the engine is. So the drift is made mechanical. Published prices are diffed against the definitions the billing system uses, and the build fails on any disagreement — a page quoting a price that would not be charged is the worst defect this site can ship. Claims the code has contradicted are added to a tripwire so they cannot reappear.
- Prices derive from one canonical source and are verified on every build, never retyped into copy
- Retired claims are enforced by a self-tested gate, proven in both directions: it must catch the wrong phrasing and must not flag the correct one
- The capabilities overview and its machine-readable version render from one approved file, so the buyer and an answer engine cannot be shown different answers
Tracked absence
What this page does not claim
The useful half of a trust page is the part that declines to assert something. These are the claims we could make vaguely and do not.
A granted patent
Patent pending is the whole claim. A U.S. utility patent application titled "Unified Multi-Domain Infrastructure Design Platform" is on file for the unified multi-domain model. It has not been examined and nothing has issued, so you will not find the word "patented" anywhere on this site — and a build check refuses it.
No SOC 2 certification
The platform is designed around SOC 2 controls and is not certified. Until an auditor signs, we say designed around, never certified, and we display no badge.
No uptime or SLA percentage
We publish no availability figure, because we do not yet publish a service level agreement to measure it against. An absent number is more honest than a flattering one.
No laboratory plot of every radio
Antenna behaviour comes from the product record: each radio’s gain, and a beamwidth where the record or the designer supplies one. An access point whose record carries no beamwidth is modelled as radiating equally in every direction, and the design proposal and site plan set say so. None of it is a chamber test of the individual unit you bought.
No single headline score
We do not lead with one composite design number. A single score compresses away the thing you actually need — which channels are usable, what conflicts exist, and what applying the plan would fix. Those are reported individually.
Mechanisms, not adjectives
Each of these is a control in the product or in this site's build — not a description of intent.
- Refuses
- to save a distance on an uncalibrated plan
- names the reason and offers the fix, rather than storing a plausible number
- Re-verifiable
- signed records, once e-signature is live (coming soon)
- hashes recomputed from the source, verdict returned per plane
Questions about the numbers
Will the product ever refuse to give me a number?
Yes, and that is deliberate. The clearest case is measurement: on a floor plan whose scale nobody has established, the measure tool will not save a length. It tells you to set the scale first. The alternative is a number in feet that looks exactly as trustworthy as a real one, which is the failure we consider worst — a confidently wrong measurement is more damaging than a missing one, because you cannot see that it is wrong.
A scale value already exists on my plan. Is that not enough?
Not on its own. A default scale is written when a plan is saved, so the presence of a positive pixels-per-foot value proves only that the field is populated. The check looks for provenance instead — a drawn reference line, a scale notation read off the sheet, CAD units, a satellite or map alignment, an auto-detected blueprint scale, or a value you declared. If one of those established the scale, you measure. If nothing did, it asks you to calibrate.
Does a design get the same confidence whether I calibrated carefully or not?
No. The method that set the scale is stored with the plan and carried into how derived figures describe themselves. A scale read from a printed notation is rated estimated rather than verified, because a printed scale is weaker evidence than a line measured against a known length. The number still appears; what changes is what it claims about itself.
Is antenna behaviour taken from a laboratory chamber?
No, and the distinction matters enough to state plainly. Each radio is modelled from the gain in its product record and, where the record or the designer supplies one, a beamwidth. An access point with no beamwidth on file is modelled as radiating equally in every direction, and the design proposal and site plan set say which applies. That is a parametric estimate, not a chamber test of your specific unit. Our documentation says so in the same words.
What stops this page from going stale as the product changes?
Scripts that break the build. Prices are diffed against the definitions the billing system uses. Claims the code has contradicted are held down by a tripwire whose own test proves it in both directions. The capabilities overview renders from one approved file shared with its machine-readable version, and a build check refuses any field or wording outside what that overview is allowed to publish. None of that makes drift impossible; it makes drift fail loudly instead of shipping quietly.
Bring the number you need to defend
Put a real floor plan in front of us and we will show you where every figure came from, including the ones the platform declines to produce.