root
3c07727f5c
Mark v5.0/v5.1 SUPERSEDED (error-detection thesis failed at -0.40 delta); v4.1 is canonical. Cut v4.1 proposal with 12 version strings bumped. Moonshot to Mistral across production seats; production worker de-kimi'd 2026-08-18. Data-retention posture corrected 7/9 to 8/9 no-training (DeepSeek sole exception). Reconciled COGS with measured Mistral spend. Committed deployed v4.0 content and research docs to resolve the repo/live fork.
229 lines
15 KiB
HTML
229 lines
15 KiB
HTML
|
|
<!-- ====== 9. DEPLOYMENT ====== -->
|
|
<section id="deployment">
|
|
<h2><span class="n">09</span>Deployment Options</h2>
|
|
<p class="lead">
|
|
Two supported deployment shapes. Both are managed by IT Pro Partner below the application layer.
|
|
</p>
|
|
|
|
<div class="strategy-cols">
|
|
<div class="defense-item">
|
|
<h4 style="margin-top:0;text-transform:none;color:var(--accent);font-size:15px">Option A · ITPP-INFRA Shared</h4>
|
|
<p>
|
|
Runs on existing netcup RS 4000 infrastructure alongside IT Pro Partner operations. Same
|
|
Wasabi S3 backup pipeline, same Caddy reverse proxy, same monitoring stack (Prometheus and
|
|
Grafana). Zero new infrastructure cost. Suitable for launch through Series A.
|
|
</p>
|
|
<ul>
|
|
<li>netcup RS 4000 (app3), Docker Compose</li>
|
|
<li>Wasabi S3 daily backups plus 15-minute sync</li>
|
|
<li>Managed by the IT Pro Partner infrastructure team</li>
|
|
</ul>
|
|
</div>
|
|
<div class="defense-item">
|
|
<h4 style="margin-top:0;text-transform:none;color:var(--accent);font-size:15px">Option B · Dedicated</h4>
|
|
<p>
|
|
Dedicated netcup or Hetzner instances with a dedicated S3 bucket. Full isolation from ITPP
|
|
operational infrastructure. Recommended for post-Series A or enterprise white-label
|
|
deployments requiring independent compliance scope.
|
|
</p>
|
|
<ul>
|
|
<li>Dedicated netcup RS or Hetzner CPX instances</li>
|
|
<li>Dedicated Wasabi S3 bucket, separate backup schedule</li>
|
|
<li>Managed by IT Pro Partner below the application layer</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
<p class="table-note">
|
|
<strong>Shared responsibility:</strong> IT Pro Partner manages everything below the application
|
|
layer (OS, container runtime, networking, backups, monitoring) under both options. The
|
|
VerdictTank application and its model pipeline are the product team's responsibility.
|
|
</p>
|
|
|
|
<div class="highlight">
|
|
<strong>Panel-specific operational requirement.</strong> Under either option the orchestrator
|
|
must hold credentials for nine separate model vendors and must run the pre-flight health gate
|
|
before every panel dispatch. Vendor credential rotation and per-vendor spend ceilings are
|
|
application-layer concerns and sit with the product team, not with infrastructure.
|
|
</div>
|
|
</section>
|
|
|
|
<!-- ====== 10. LEGAL, PRIVACY, COMPLIANCE ====== -->
|
|
<section id="legal">
|
|
<h2><span class="n">10</span>Legal, Privacy & Compliance</h2>
|
|
<p class="lead">
|
|
Trademark clearance, the Minimum Viable Legal framework, the controller and processor role map,
|
|
the sub-processor training guard, corpus confidentiality, and incident response. Carried forward
|
|
from v4.0 and updated for the nine-vendor panel.
|
|
</p>
|
|
|
|
<h3>10.1 USPTO trademark clearance: "VerdictTank"</h3>
|
|
<p>
|
|
<strong>Status: preliminary clearance only. This is not a substitute for a formal search.</strong>
|
|
This assessment was performed with open-web search tools only. USPTO TESS is a
|
|
JavaScript-rendered application and a static fetch returns only the search shell with no query
|
|
results. Before any trademark application is filed, a live interactive TESS search or a paid
|
|
clearance search through a trademark attorney is required.
|
|
</p>
|
|
|
|
<h4>Open-web common-law search results (performed)</h4>
|
|
<table>
|
|
<thead><tr><th>Search</th><th>Result</th><th>Assessment</th></tr></thead>
|
|
<tbody>
|
|
<tr><td>"VerdictTank" exact, web-wide</td><td>Only hit is verdicttank.com itself</td><td>No third-party commercial use found</td></tr>
|
|
<tr><td>"Verdict Tank" space variant</td><td>Two incidental unrelated hits, neither a business nor a registered mark</td><td>No competing commercial use. Matches are noise.</td></tr>
|
|
<tr><td>Trademarkia and Justia proxy queries</td><td>No results returned</td><td>Consistent with no existing registration, but not equivalent to direct TESS</td></tr>
|
|
<tr><td>Domain: verdicttank.com</td><td>Live, owned, serving the product</td><td><strong>Primary domain.</strong> Confirms operational use in commerce.</td></tr>
|
|
<tr><td>Domain: rfptank.com</td><td>Legacy holding, same naming convention</td><td><strong>Defensive only.</strong> Retained against a family-of-marks argument. Not a product surface.</td></tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<h4>Recommendation</h4>
|
|
<ul>
|
|
<li>Before Series A close or any public marketing scale-up, commission a formal USPTO clearance search for Classes 9, 42, 35 and 45.</li>
|
|
<li>File an intent-to-use application for VERDICTTANK as a standard character word mark, Class 42 primary and Class 9 secondary.</li>
|
|
<li>Do not file on the basis of this document alone. It is a preliminary desk review.</li>
|
|
</ul>
|
|
|
|
<h3>10.2 Minimum Viable Legal (MVL) framework</h3>
|
|
<p>
|
|
MVL is the internal gate name used in the architecture documents as the precondition for
|
|
onboarding white-label and enterprise customers. It is not one document. It is five interlocking
|
|
instruments that must all exist and be internally consistent before the white-label provisioning
|
|
gate turns green.
|
|
</p>
|
|
<table>
|
|
<thead><tr><th>Component</th><th>Purpose</th><th>Applies to</th><th>Status</th></tr></thead>
|
|
<tbody>
|
|
<tr><td>Terms of Service</td><td>Governs the contractual relationship with every direct user</td><td>All tiers</td><td>Drafting required</td></tr>
|
|
<tr><td>Privacy Policy</td><td>GDPR and CCPA compliant notice of collection and use</td><td>All tiers</td><td>Drafting required</td></tr>
|
|
<tr><td>Data Processing Addendum</td><td>Article 28 GDPR processor terms</td><td>Enterprise, white-label</td><td>Hard gate on white-label</td></tr>
|
|
<tr><td>AI Disclaimer (DISC-001)</td><td>Non-removable versioned notice: output is AI opinion, not professional advice</td><td>Every scored surface</td><td>Engineering spec complete, legal copy needs counsel sign-off</td></tr>
|
|
<tr><td>Limitation of Liability</td><td>Caps aggregate liability at the lesser of $100 or fees paid in the preceding 12 months</td><td>All tiers, embedded in ToS</td><td>Drafting required</td></tr>
|
|
<tr><td>Governing law and venue</td><td>Recommend Delaware law with Georgia venue, pending confirmation of incorporation state</td><td>All tiers</td><td>Pending counsel</td></tr>
|
|
<tr><td>GDPR readiness</td><td>Lawful basis mapped per role. Articles 28, 33 and 34. SCCs or IDTA for EU transfers.</td><td>Any EU user</td><td>Framework mapped, SCC execution pending white-label launch</td></tr>
|
|
<tr><td>CCPA and CPRA readiness</td><td>Service-provider contract terms and a consumer rights workflow</td><td>Any California resident</td><td>DSAR workflow build pending</td></tr>
|
|
</tbody>
|
|
</table>
|
|
<p class="table-note">
|
|
The Free, Pro and Enterprise tiers require Terms of Service, Privacy Policy and the AI Disclaimer
|
|
at minimum before any paid launch.
|
|
</p>
|
|
|
|
<h3>10.3 Controller and processor role map</h3>
|
|
<table>
|
|
<thead><tr><th>Data flow</th><th>Role</th><th>Legal basis</th><th>Agreements required</th></tr></thead>
|
|
<tbody>
|
|
<tr><td>Free tier submission and review</td><td>Controller</td><td>Contract plus legitimate interest</td><td>ToS, Privacy Policy</td></tr>
|
|
<tr><td>Enterprise org admin and org users</td><td>Joint controller</td><td>Performance of contract</td><td>ToS, Enterprise DPA (Art. 26 GDPR)</td></tr>
|
|
<tr><td>White-label tenant end-users</td><td>Processor</td><td>Tenant's instructions</td><td>DPA, SCCs or IDTA, published sub-processor list</td></tr>
|
|
<tr><td>Panel model API calls, all nine vendors</td><td>Controller of the vendor relationship. Each model vendor is a sub-processor.</td><td>Legitimate interest</td><td>Sub-processor training guard plus a DPA with each vendor</td></tr>
|
|
<tr><td>Corpus contribution (aggregate scores and structural metadata)</td><td>Controller, secondary-use basis</td><td><strong>Opt-in consent.</strong> Cannot ride on contract or legitimate interest under the purpose limitation principle, Art. 5(1)(b).</td><td>Explicit opt-in UI, anonymization pipeline, retention separate from the review record</td></tr>
|
|
</tbody>
|
|
</table>
|
|
<div class="callout">
|
|
<strong>The nine-vendor panel raises the sub-processor row from a formality to the primary
|
|
compliance surface.</strong> Every additional vendor seat is an additional sub-processor that
|
|
must carry a confirmable training opt-out before it can receive customer content. A vendor that
|
|
cannot satisfy the guard below cannot hold a panel seat, regardless of how well it scores.
|
|
</div>
|
|
|
|
<h3>10.4 Sub-processor training guard</h3>
|
|
<h4>Model clause for vendor DPAs</h4>
|
|
<div class="arch-box">
|
|
Vendor shall not use Customer Data (including all inputs, outputs, prompts, completions,
|
|
and any content submitted via the Vendor's API) to train, fine-tune, retrain, or otherwise
|
|
improve any machine learning model, except with Customer's prior written consent on a
|
|
per-instance basis. Vendor shall not retain Customer Data beyond the minimum period
|
|
technically necessary to provide the API response.
|
|
</div>
|
|
<p>
|
|
<strong>Enforcement rule:</strong> a vendor without a public, contractually confirmable training
|
|
opt-out is excluded from the panel roster entirely and cannot be selected as a failover target.
|
|
The only acceptable path for a non-compliant provider is a customer-side, explicit, revocable
|
|
opt-in. Never a silent default, and never for corpus-eligible content. Each of the nine rostered
|
|
vendors is audited against this clause before it is eligible for a seat, and the audit is
|
|
re-run at each roster revision.
|
|
</p>
|
|
|
|
<h3>10.5 Corpus confidentiality</h3>
|
|
<p>
|
|
The corpus is VerdictTank's most valuable long-term asset and its highest confidentiality
|
|
exposure.
|
|
</p>
|
|
<table>
|
|
<thead><tr><th>Data type</th><th>Corpus-eligible</th><th>Rationale</th></tr></thead>
|
|
<tbody>
|
|
<tr><td>Dimension scores and panel spread statistics</td><td>Yes, opt-in</td><td>Structural, not identifying. Core signal.</td></tr>
|
|
<tr><td>Structural metadata (vertical, length bucket, revision count, deltas)</td><td>Yes, opt-in</td><td>Enables content and moat analytics</td></tr>
|
|
<tr><td>Raw proposal text</td><td><strong>Never</strong></td><td>Confidential business content plus potential third-party PII</td></tr>
|
|
<tr><td>Explanation and audit finding text</td><td><strong>Never</strong> in raw form</td><td>Critique text frequently quotes the submission verbatim</td></tr>
|
|
<tr><td>Chat refinement transcripts</td><td><strong>Never</strong> as transcript content</td><td>Highest incidental-PII risk of any input surface</td></tr>
|
|
</tbody>
|
|
</table>
|
|
<h4>Anonymization pipeline</h4>
|
|
<ol>
|
|
<li><strong>Source-content exclusion.</strong> Raw text fields excluded at the schema and ETL level.</li>
|
|
<li><strong>Structural extraction only.</strong> ETL reads scored and aggregated fields, never freeform text.</li>
|
|
<li><strong>Identifier stripping.</strong> Review, user and org identifiers replaced with a one-way surrogate key.</li>
|
|
<li><strong>Free-text quarantine.</strong> A stricter named-entity pass before any inclusion.</li>
|
|
<li><strong>k-anonymity floor.</strong> Public content published only when the cohort exceeds a minimum threshold.</li>
|
|
</ol>
|
|
<p class="table-note">
|
|
Corpus contribution is off by default and requires explicit, separate opt-in. It is not bundled
|
|
into ToS acceptance and is revocable at any time from account settings.
|
|
</p>
|
|
|
|
<h3>10.6 Incident response</h3>
|
|
<p>Structured around the six functions of NIST CSF 2.0.</p>
|
|
<table>
|
|
<thead><tr><th>Function</th><th>VerdictTank action</th></tr></thead>
|
|
<tbody>
|
|
<tr><td>Govern</td><td>Named incident commander. Breach classification criteria documented before any incident.</td></tr>
|
|
<tr><td>Identify</td><td>Asset inventory: transactional database, corpus database, credentials for all nine model vendors, white-label tenant segments.</td></tr>
|
|
<tr><td>Protect</td><td>Row-level-security multi-tenant isolation, sanitization gate, sub-processor training guard, per-vendor spend ceilings.</td></tr>
|
|
<tr><td>Detect</td><td>Alerting on anomalous data access, bulk export, and cross-org query attempts. Health-gate telemetry on every panel dispatch.</td></tr>
|
|
<tr><td>Respond</td><td>GDPR: 72-hour notification to the supervisory authority (Art. 33). CCPA: notification without unreasonable delay.</td></tr>
|
|
<tr><td>Recover</td><td>Post-incident review documented. White-label tenants notified per their individual DPA terms.</td></tr>
|
|
</tbody>
|
|
</table>
|
|
|
|
<h4>Wrong-verdict liability</h4>
|
|
<p>
|
|
<strong>Scenario:</strong> a customer submits a proposal, receives a favorable panel verdict,
|
|
acts on it, and the verdict was wrong in a way that led to a bad decision. This is primarily a
|
|
reputational risk. The liability cap bounds legal exposure and does nothing for reputation.
|
|
</p>
|
|
<ul>
|
|
<li><strong>Legal layer:</strong> the AI disclaimer fails closed on every surface, a $100 or 12-months-of-fees liability cap applies, and the terms explicitly instruct users not to rely on AI output for investment decisions.</li>
|
|
<li><strong>Confidence calibration:</strong> every verdict ships with panel spread, standard deviation, and outlier flags. A verdict with a 5.4-point spread is a materially different signal from a unanimous one, and the report says so on its face.</li>
|
|
<li><strong>The published FAIL:</strong> section 3 of this document is itself part of the defense. We publish the case where our own thesis failed, which is a stronger honesty posture than any disclaimer.</li>
|
|
<li><strong>Incident playbook:</strong> do not litigate merits publicly, point to the auditable disclaimer version shown to the user, offer a private re-review, and disclose plus correct any systematic flaw found.</li>
|
|
</ul>
|
|
|
|
<h4>Model provider outage disclosure</h4>
|
|
<ul>
|
|
<li><strong>Public status page</strong> distinguishing VerdictTank infrastructure incidents from upstream model provider incidents.</li>
|
|
<li><strong>Degraded-mode behavior:</strong> a panel that ran short of its full eleven seats is flagged visibly with the seat count and which roles failed over. We never silently substitute a provider without disclosure. The 2026-08-12 run is reported at 8 of 11 seats throughout this document for exactly that reason.</li>
|
|
<li><strong>SLA language:</strong> uptime commitments are qualified as dependent on upstream provider availability.</li>
|
|
</ul>
|
|
</section>
|
|
|
|
</main>
|
|
|
|
<footer>
|
|
<div class="wrap">
|
|
VerdictTank v5.0 · <a href="https://verdicttank.com">verdicttank.com</a> ·
|
|
<a href="architecture.html">Technical Architecture</a> ·
|
|
<a href="judge-pool-spec.md">Judge Pool Spec v2.3</a> ·
|
|
<a href="index-v4.0.html">Prior version (v4.0)</a><br>
|
|
Pre-revenue. Thesis revised on measured data from the 2026-08-12 validation run.
|
|
All domain references are <code>verdicttank.com</code>; <code>rfptank.com</code> is retained
|
|
as a defensive holding only.<br>
|
|
Every score, delta, spread and error count on this page comes from that run. Nothing is projected.
|
|
</div>
|
|
</footer>
|
|
</body>
|
|
</html>
|