Whose machines this runs on, and what reaches them.

What they hold. The whole machine, and since 2026-08-04 that means the product and not only the pages. The static pages, the video on the landing page, the certificate's private key, the request log nginx writes — and now the SQLite database on the host disk: every account and password hash, every session row, every document loaded into the demonstration workspace, every claim, and the whole audit chain. Why. The site and the application run on a virtual machine rented from them. Where. DigitalOcean, LLC is a United States company; the address is 143.198.140.28, which their own registration record shows as theirs. Which region the machine sits in is not stated here, because it was not checked.

Two things a buyer should know about that machine. It is shared. The original plan gave Verbatim its own disposable box; no credential existed to create one, so it went onto a droplet that already serves another of the author's projects, alongside that project's commercial data. That is a smaller boundary than the plan asked for, and ADR-10 in the decision record sets out what was traded and what would move it back. And nginx logs every request by default — the address it came from, the page asked for, the time and the browser's user-agent line. How long the host keeps that log is not claimed here, because the host's log settings were not read.

What they hold. The domain sudama.ai and the name servers that answer for it, ns29 and ns30.domaincontrol.com. What reaches them. The lookups that turn verbatim.citelocal.ai into an address: the name asked for and the resolver that asked. Not the page you then read, and nothing you type into it. Why. The domain was registered there. Where. GoDaddy.com, LLC is a United States company.

What they hold. The certificate that makes this page arrive over HTTPS, issued to the name verbatim.citelocal.ai and to nothing else. What reaches them. The host name, and a proof that this server controls it. No person's data goes into a certificate request. Worth saying out loud. Every certificate is published to public transparency logs, so the host name is public whether or not anything on it is. Where. Issued by the Internet Security Research Group, a United States non-profit.

The assistant panel is on every screen and posts to /chat. app/web/views/chat.py resolves app/chat/engine.py, which calls run_turn in app/chat/agent.py, which builds an AnthropicTransport and calls messages.create against the model claude-opus-5. The key comes from ANTHROPIC_API_KEY: app/config.py reads it out of .env into the process at start, and deploy/compose.yml passes an environment file into the container. With no key the transport is never built, the assistant says it is unavailable, and nothing is sent — that refusal is tested, and it is not a canned answer dressed up as a real one.

Three things, per turn. The question, as typed. A short prompt naming the person's display name, the company's name, and the permission codes they hold. The results of any tool the model chose, from app/chat/tools.py. There are ten tools and they read the record: projects with their jurisdiction, docket reference, status and owner; obligation titles with the owner's display name and account id; open escalations with their ids, claim ids and the reason each one is withheld; the approval route step by step, with the label of each step and who it falls to; claim statements whose citation verifies, with the quoted source that earned them; and up to 600 characters of the stored filing text on each side of a change. Two tools write rather than read: one opens a project, one files a note against one. This is company context, not only public filing text.

A claim whose citation does not verify never reaches the model as a statement. One function turns a withheld claim into wire form — _withheld_payload in app/chat/tools.py — and it emits the reason, the reason code and the ids, never the statement, never the quote, never the source excerpt. The object carrying a withheld claim has no statement field to read. Also not sent: the session token, the cookie, any password hash, and the API key itself. The model is never given the company id or the identity it is acting under — those are injected by the server, and a model that supplies one halts the turn and leaves a row in the audit chain.

Bounded per call, not per conversation. One call carries at most 25 rows from a tool, 600 characters of filing text on each side of a change, and at most four rounds of tool calls in a turn. Prior turns are not resent — the shim drops the history the screen offers it. But nothing caps how many turns a person takes, so the total that reaches Anthropic over a conversation, or over a day, has no ceiling in this build.

app/interpretation/propose.py asks a model what changed between two versions of a filing, and it is also written against Anthropic's API. Nothing in the application calls it: outside its own test it has no caller in this repository. So it is a second door onto the same vendor, and today only the chat door is open.

Nothing. There is no data processing agreement, no commercial terms, no zero-retention arrangement and no statement about training on inputs — because there is no legal entity here to sign one and nobody has negotiated anything. The calls run against an ordinary API key on whatever terms Anthropic publishes for one, and this page has not read those terms into a promise on their behalf. The minimisation described above is what the code does; it is not a contract, and nobody outside this repository is bound by it. A buyer should treat this as the largest open item on the page.

Anthropic is a United States company. Which region a request is served from is not stated here, because it was not checked.

Gmail. Mail sent to the address at the foot of these pages lands in an ordinary personal Gmail mailbox, and Google's terms govern it — the privacy page says the same. That is the operator's mailbox for correspondence, not somewhere Verbatim puts your documents. The environment file also names Gmail credentials for a user-research outreach script; no such script exists in the repository, and no code in it sends mail.

GitHub. The source lives in a private repository at github.com/jsahasi/verbatim. It holds the code, both corpora and a set of public filings downloaded from state commissions' own document systems. It holds nobody's documents.

Traefik and Coolify. These appear in the decision record and they are programs on the same rented machine, not companies that receive anything. The repository's nginx configuration listens on plain HTTP only, and the public address answers over HTTPS, so a proxy in front of nginx holds the certificate; ADR-11 records which one and why it is not the one originally chosen. Nothing leaves the machine through them except the certificate request already listed above.

The software libraries. FastAPI, uvicorn, SQLAlchemy, Pydantic, Jinja, httpx and the Anthropic SDK run inside the process on the same machine. A library is not a company receiving data. The only one of them that sends anything anywhere is the Anthropic SDK, and the section above says what it sends and to whom.

Things that are simply absent. No analytics, no error tracking, no content delivery network, no external fonts or scripts, no customer support tool, no marketing platform, no payment processor — nothing is for sale — and no off-host backup: the repository's backup script writes a verified snapshot to a directory on the same disk and has no remote destination anywhere in it. No page here fetches anything from another host, which is checkable by reading the source.