Trust & evidence

Proof anyone can verify. AI anyone can audit.

A compliance platform has to meet a higher bar than the companies it serves. Every pack is signed and chained, every chain belongs to one customer, and every AI suggestion carries the name of the person who accepted it.

EV-…4470 · 0x41c9…77ad
EV-…4471 · 0x6e1d…a90b
EV-…4472 · 0x2b77…04feverified ✓

Synthetic Mintwell evidence; abbreviated hashes are illustrative.

Anatomy of an evidence pack

Six things every examiner asks for, sealed together.

01 · obligation

The rule

Authority, layer and version of the obligation.

02 · mapping

The reasoning

Why this control addresses that rule.

03 · data

The data

Records in scope and the control result.

04 · reviewer

The decision

The approver, role, decision and notes.

05 · ai_engine

The AI’s part

The draft, confidence and source context.

06 · ledger

The seal

The record hash and its predecessor.

{
  "evidence_id": "EV-2026-10-4472",
  "obligation": {
    "id": "GENIUS.Redemption",
    "layer": "regulation",
    "authority": "OCC",
    "version": "2026-08"
  },
  "mapping": {
    "control": "C-RED-03",
    "rationale": "Pass condition matches the two-business-day rule."
  },
  "data": {
    "records_in_scope": 4112,
    "late": 0
  },
  "reviewer": {
    "name": "Dana Whitlock",
    "role": "Treasurer",
    "decision": "approved"
  },
  "ai_engine": {
    "confidence": 0.93
  },
  "ledger": {
    "prev": "0x6e1d…a90b",
    "hash": "0x2b77…04fe",
    "chain": "mintwell-private"
  }
}

This pack, its person, identifiers and numbers are synthetic. Hash placeholders are not verifiable signatures.

Your own private chain

One chain per customer. No shared ledger, ever.

Customer-isolated records link each pack to its predecessor. Verification checks integrity; permission controls who can read the underlying evidence.

Mintwell

Your chain

Customer B

Sealed off

Customer C

Sealed off

Synthetic architecture: Mintwell is isolated from Customer B and Customer C. No cross-customer ledger links. Only permissioned sharing grants access.

Responsible AI

The AI proposes. A person decides. The record shows both.

Named approval

A person approves every material control change, exception and decision.

Confidence on drafts

Uncertainty stays visible instead of being hidden behind a polished answer.

Traceable to source

Suggestions point to the source rule and supporting evidence.

Edits stay visible

The original proposal and the reviewer’s changes remain in the record.

Security programme

Fewer dependencies. Fewer ways in.

Our programme is designed around least privilege, customer isolation, encryption, auditable access and a small operational footprint.

Limit access

Scoped permissions, deliberate access reviews and attributable actions.

Protect the record

Encryption in transit and at rest, with controlled key access.

Prepare to recover

Documented incident handling, backup and recovery testing.

Programme design and roadmap, not an attestation of independently verified controls.

Transparent by default

Our own compliance roadmap

Targets are placeholders, not completed certifications. Ask us for the current scope, status and available evidence.

Planned assurance work; no certification claimed
Programme	Planned work	Status
SOC 2 Type I	Independent point-in-time examination	Target date pending · placeholder
SOC 2 Type II	Operating-effectiveness examination after an observation period	Target date pending · placeholder
ISO 27001	Information security management system assessment	Target date pending · placeholder
GDPR / UK GDPR	DPA, subprocessor transparency and residency review	Target date pending · placeholder
DORA	Customer contract and ICT risk support	Target date pending · placeholder
HIPAA	Healthcare scope and BAA review where applicable	Target date pending · placeholder

Want our security pack for your vendor review?

Open an email request. Nothing is submitted or stored by this page.

Request early access →