Customers verify our claims with math, not marketing.
Every operational signal AssetShop produces carries a cryptographic SHA-256 fingerprint, hash-chained for anchoring to a tamper-evident public audit chain (external anchoring activates Q3 2026 post security audit; dry-run mode today). Capabilities are calibrated LIVE, IN PROGRESS, or PLANNED with target dates. The Day 90 outcome warranty is contractual. Public policies are directly downloadable.
Why we exist. What we are building toward. How we hold ourselves to it.
A trust center is the contract a company offers itself before any auditor arrives. These three statements are the constraints we accept before any pressure does.
Restore the operator's ability to see the whole enterprise at once — without replacing the systems they have already paid for.
Two decades of best-of-breed specialization gave every function its best tool and the C-suite an incoherent picture. We build the layer above the stack so the people who carry the consequences of decisions can see the consequences before they decide. That is the work.
A decade from now, every consequential enterprise decision will be made on verifiable, source-attributed evidence — and the path from observation to action will be auditable end-to-end.
The default state of enterprise decision-making is opinion masquerading as data. Our vision is the inverse: a working surface where every number on every screen traces back to the source system that produced it, every recommendation cites the evidence behind it, and every action leaves a record auditors can verify without our cooperation. Trust earned by construction, not by claim.
Six commitments we hold before any deal closes.
Calibration over polish
We label every capability honestly: built and operating, built and integrating, or shipping later. A polished claim we cannot defend is worse than a calibrated one a customer can verify.
Source systems stay authoritative
ERPs, MES, WMS, PLM, CRM are the systems of record. We sit on top of them, never between. Read-only by architecture — not by policy. The line cannot be argued past.
Hours reclaimed, not headcount removed
Customers commit in writing that hours we give back will fund growth, customer service, training, or new-segment expansion. The dignity of the people doing the work is part of the warranty.
Verifiable, not just trusted
Every observation carries a SHA-256 hash. Customers can verify our calibration claims without our help. Trust is the outcome of construction, not the input to selling.
Bring your own intelligence
We do not lock customers into a particular reasoning engine. The platform composes evidence; how a customer chooses to apply judgment on top of it is their architectural choice, not ours. Sovereignty over thinking, not just data.
Outcomes binary, refunds real
Day 90 is SUCCESS, EXTEND, or REFUND — signed before Day 0. We hold the financial consequence of being wrong. That is the line between conviction and marketing.
“The cheapest time to keep a promise is before you make it.”
Information only. Decisions belong to the customer.
AssetShop surfaces insights, signals, recommendations, and analytical outputs based on data read from customer source systems. We are not a registered investment advisor, broker-dealer, financial advisor, legal counsel, accountant, or regulatory compliance authority. The following six clauses document where our work ends and the customer's responsibility begins.
Advice, not execution
AssetShop SCO surfaces signals and recommendations. Information presented should not be construed as investment, financial, tax, legal, accounting, or regulatory advice.
Decisions belong to customer
All hedging, sourcing, supplier-award, capacity-investment, regulatory-disclosure, treasury, and operational decisions remain with the customer's procurement, finance, treasury, legal, compliance, and operations functions.
Outcomes vary
No insight or recommendation can guarantee a specific business outcome. Markets shift, suppliers fail, regulations change. The Day-90 Outcome Warranty is a money-back commitment on first captured value documentation - not a guarantee of any specific dollar amount, return rate, or business result.
Read-only architectural posture
AssetShop SCO does not execute trades, place hedge contracts, issue purchase orders, bind contracts, modify ERP transactions, instruct treasury operations, or commit the customer to any third-party obligation. All execution remains in customer-controlled source systems on the customer's normal workflow.
Verify before acting
Customer is responsible for independent verification of all market data, financial figures, supplier information, regulatory deadlines, certification claims, carbon-emissions data, counterparty health signals, and other analytical outputs before taking action. Engaging qualified legal, financial, tax, regulatory, and compliance advisors for material decisions is the customer's responsibility.
Liability & indemnification
MSA Section 11 (Limitation of Liability) and Section 12 (Indemnification) document the precise legal boundaries. Standard SaaS liability caps apply (typically 12 months of fees paid). AssetShop is not liable for indirect, incidental, consequential, special, exemplary, or punitive damages.
Customer keeps platform learnings inside the organization.
Customer is obliged not to share AssetShop's proprietary platform features, capabilities, derivation methodologies, calibration insights, configuration learnings, or related operational know-how outside the Customer organization. This includes published content, public RFP responses, conference presentations, vendor benchmark comparisons distributed beyond the buying team, social media disclosures, blog posts, podcasts, press interviews, and any other public distribution channel.
Permitted internal use: Customer may use platform documentation freely for internal training, audit-defense preparation, executive briefings, internal RFP responses, M&A diligence rooms (under standard NDA flow-down), and operational reference. NDA-bound advisors and auditors operating on Customer's behalf are permitted recipients under standard confidentiality flow-down language.
What this protects: the methodology disclosures, signal-derivation explanations, capability descriptions, and parameter-tuning approaches that AssetShop shares with Customers are a competitive asset. Sharing them publicly degrades the protected value all Customers receive. Violations are governed by MSA Section 12 (Remedies). Standard exceptions for compelled disclosure (subpoena, regulatory inquiry) apply with required-notice obligation back to AssetShop.
If we miss, you get the money back.
Every Founding-5 pilot is bound by a Day 90 binary outcome determination signed before Day 0. SUCCESS, EXTEND, or REFUND - against a dollar-denominated threshold the customer's CFO and AssetShop's founder both sign. No vendor in our category writes this into the MSA.
Customer attests to validated savings or leakage at or above the Day 0 threshold. Founding-5 subscription begins. Pilot fee credited to subscription.
Joint determination that trajectory will reach threshold by Day 180. No additional pilot fee. Customer decides whether to extend or refund at Day 180.
Pilot fee refunded cleanly via ACH within 30 days. No subscription auto-converts. Customer keeps all derivative work product from the pilot.
Day 90 dollar thresholds are set jointly with the customer's CFO and CPO during contract finalization, calibrated to the customer's specific operational profile. The threshold is documented as MSA Exhibit F and signed before Day 0.
Every event is cryptographically anchored.
Each operational event produces a one-way SHA-256 fingerprint. AssetShop's audit log is hash-chained and the chain root is anchored to a tamper-evident, independently verifiable external anchor. Anchor cadence is configurable - default weekly, near-real-time on customer request. Only opaque hashes are public. Event contents stay within the tenant. The chain proves data existed at anchor time without exposing what it is.
AssetShop reads from ERPs, procurement, planning, WMS, MES, TMS. Every read is recorded as an event with a SHA-256 fingerprint.
Every event links to its predecessor by hash. Merkle tree root computed from the chain at each anchor interval.
Merkle root committed to a tamper-evident external anchor via the AssetShopAnchor service. Anchor receipt returned. Permanent and independently verifiable.
Customer or auditor verifies any event against the L2-anchored root using npx @assetshop/verify-cli. No AssetShop infrastructure needed.
Every claim ships with a cryptographic receipt.
Most vendors ask you to trust their dashboard. AssetShop hands you the math. Every signal, export, and audit event can be re-derived independently - no AssetShop dependency, no trust-me claims.
Tamper-evident audit anchor
Hash-chained event roots built and persisted in dry-run; external anchoring (default weekly cadence). Permanent, immutable, independently auditable.
How it works →Open-source verify-cli
Customers independently re-derive every claim. npx @assetshop/verify-cli. No AssetShop dependency.
Per-export receipt files
Every Excel export ships with a .receipt.json sidecar. SHA-256 of the file, Merkle path to the anchored root, signer identity.
ZK proof of variance
Prove a variance threshold was exceeded without revealing the underlying procurement data. For regulated industries and supplier disputes.
SCAFFOLD · research phaseTypeable tenant identity
Each tenant gets a subdomain (e.g., your-co.assetshop.eth) resolving to verifiable tenant metadata. Portable identity across AssetShop releases.
Outcome-anchored escrow
Pilot fee held in escrow; released on cryptographically-verified outcome (Day 90 + Exhibit F validation). Reduces counterparty trust requirement.
PLANNED · counsel-pacedLIVE surfaces are available today. Q4 2026, Q2 2027, Q3 2027 targets are good-faith estimates, not contractual commitments. Counsel review of each anchoring feature is mandatory before launch. The tamper-evident audit chain is the only cryptographic-anchoring surface AssetShop exposes; all customer payments are conventional bank-rail (ACH, wire).
The honest status. Not the aspirational claim.
Every capability is labeled LIVE (operating today), IN PROGRESS (active build with target date), or PLANNED (dated roadmap commitment). Each entry is anchored to the audit chain and can be independently verified.
| Capability | Status | Target |
|---|---|---|
| SOC 2 Type I bridge letterIndependent auditor opinion · pre-Type II | In progress | Q4 2026 est. |
| SOC 2 Type II reportFull audit period observation | In progress | Q1 2027 est. |
| Tamper-evident audit anchor contractAssetShopAnchor · post security audit | In progress | Q3 2026 |
| WCAG 2.2 Level AA conformanceAutomated + quarterly manual audit | Live | Conformance v1.0 |
| Open-source verify-cli@assetshop/verify-cli on npm · MIT | Live | v1.0 published |
| Day 90 outcome warrantyMSA Exhibit F · contractually enforceable | Live | Standard |
| 34 adapter scaffolds8 source-system adapters + 24 adjacent · TypeScript contracts complete | Live | All domains |
| Adapter customer-tenant validationLive test against real ERP sandboxes per customer engagement | In progress | Per Founding-5 onboarding |
| Excel/CSV ingestion pathAlternative-to-integration for any system | Live | 7 canonical schemas |
| Cyber Liability InsuranceTarget: $10M aggregate / $5M per occurrence | Binding | Pre first customer signature |
| Tech E&O InsuranceTarget: $5M aggregate | Binding | Pre first customer signature |
| Commercial General LiabilityTarget: $2M / $4M aggregate | Binding | Pre first customer signature |
| Delaware C-Corp transitionFrom PA sole-proprietor LLC; counsel-paced | In progress | Pre first customer signature |
| Custom domain (platform.assetshop.com)Vanity domain + TLS + EU edge proxy for customer-data surfaces | Planned | Pre first customer signature |
| Source code escrowThird-party escrow agent · released on insolvency | Planned | At first customer signature |
| Backend infrastructure-as-codeTerraform · Firebase Functions · Firestore · Storage · KMS | Live | v1.0 ready |
| Production backend deploymentFirst customer tenant stand-up | In progress | On first signed customer |
| CI/CD pipelineGitHub Actions · WIF · automated smoke tests | Live | v1.0 ready |
| Read-only architectureHard-coded at adapter contract level | Live | By design |
| Tenant isolationFirestore rules + Storage rules + custom claims | Live | By design |
| Per-tenant residencyUS East · US West · EU Central | Live | 3 regions |
| EU AI Act + NIST AI RMF alignmentAI Safety Policy v1.0 | Live | Policy F-01 |
| ISO 27001 certificationInformation security management | Planned | 2027 |
| 99.95% / 99.99% SLA tiersRTO 4hr · RPO 15min · enterprise tier | Live | Standard / Enterprise |
RTO = Recovery Time Objective (max time to restore service). RPO = Recovery Point Objective (max acceptable data loss measured in time).
Every adapter ships with a cryptographic conformance certificate.
Incumbents treat integration as a trust black box. AssetShop inverts this: every adapter in the 57-adapter portfolio carries a public calibration entry, and each ships with a 12-check conformance scorecard documenting exactly what it reads and what it cannot do. A Conformance Certificate publishes per adapter as each passes its live gate (12/12). Customers verify with math, not vendor assurances.
Every adapter publishes endpoints used, fields extracted, rate-limit posture, read-only attestation, and source SHA-256. Anchored to a tamper-evident external anchor. Verifiable by anyone.
Every customer's Day 90 outcome (anonymized) refines the ROI methodology for the next prospect. The longer AssetShop runs, the more accurate the CFO deck becomes. Competitors cannot replicate without the install base.
Customers and auditors verify every claim using npx @assetshop/verify-cli - no AssetShop infrastructure needed. The audit trail remains verifiable even if AssetShop ceases operations.
Any prospect, customer, or auditor can verify a Conformance Certificate independently. The command below verifies the SAP S/4HANA adapter against its Q2 2026 anchored certificate:
The policies your audit committee actually reads.
Twelve counsel-ready policy drafts · privacy, security, IP, continuity, and feedback data processing · directly downloadable below. The full library covers everything procurement and CISO review packs typically request. For operational disclosure requests beyond what is published, contact AssetShopCo@gmail.com.
Public · directly downloadable
Verify before you trust.
Run the open-source CLI. It fetches the L2-anchored root and recomputes the local hash chain. Match → integrity proven. Mismatch → our claims are demonstrably false. Your CISO and auditors read every line before installing.
npm install -g @assetshop/verify-cliverify-cli event <ID>✓ INTEGRITY VERIFIED$ npx @assetshop/verify-cli event EVT_2026Q2_847291 → Event payload retrieved (87 bytes) → Hash chain reconstructed (247 predecessor events) → Merkle proof verified against published anchor (checkpoint 18472491) → Comparing root: 0x7f3a8c12...c19b94e ✓ INTEGRITY VERIFIED · event is authentic and unmodified
verify-cli outcome-warranty <customer-slug>
verify-cli residency <tenant-slug>
verify-cli chain --since 2026-Q1
The question every procurement team asks. Answered before you ask.
AssetShop SCO is, at this stage, a solo-founder operation. Bus factor is 1. Most vendors hide this; we acknowledge it and publish our mitigation. Below is the customer-shareable summary of our continuity plan - the full runbook is available under MNDA. The plan is drilled annually, contractually bound in MSA §14 / §15 / Exhibit J, and the audit chain that proves your data continues to exist is independently verifiable against the external anchor even if AssetShop ceases to exist.
- Your tenant continues to operate. No data loss. No service interruption beyond a possible 1-2 hour partial-outage window during credential handover.
- Your audit chain remains verifiable forever. Even in a worst-case wind-down, the external anchor + open-source verify-cli let your auditor verify history without AssetShop existing.
- 90 days of read-only access if wind-down ever occurs, with full data + audit chain export.
- Contractually binding in MSA §14 (continuity), §15 (wind-down), Exhibit J (Tier-4 custodian), DPA §11 (data/audit export).
- This plan does not eliminate bus factor 1. It mitigates impact. Hiring is the only true elimination.
- We do not guarantee zero downtime through credential handover. 1-2 hours of partial outage is plausible.
- We do not commit to a permanent successor by name. Wind-down (Option C) is a real possibility for any solo-founder venture.
- This plan's usefulness depends on the founder maintaining the custody chain. Quarterly review is mandatory; lapses degrade the plan.
Quarterly: anchor wallet 2-of-2 multi-sig signing tested (KMS primary + paper backup seed in lawyer escrow).
Per signing: acting operator runs a staging deploy drill after each new Founding-5 customer.
Performance improves over time. Without your raw data ever leaving your tenant.
Static thresholds stale fast. Operator feedback is the cheapest signal we have to make detection sharper. We collect it, with two firm rules: per-tenant adaptation stays inside your tenant boundary, and cross-tenant aggregates require explicit opt-in and pass K-anonymity + differential privacy gates before publication. No raw customer data leaves your tenant in either path. This is principled statistics, not "AI learning" - we don't claim more than we deliver.
- Operator-set min/max bounds (threshold can never violate these)
- Pin (force-constant) any signal's threshold at any time
- Reset to default with one click
- Opt out of per-tenant learning entirely (default is opt-in)
- Raw event payloads (records, identifiers, amounts)
- Per-tenant signal values (only aggregate-of-aggregates)
- Any tenant-identifiable pattern (categorical buckets only)
- Anything not in our approved categorical schema
- Recommendation event kinds (surfaced, actioned, dismissed, outcome)
- Categorical buckets (domain, industry, size, region, outcome window)
- SHA-256 hash of the event payload (for audit chain only)
- Acting principal (user_id or system service principal)
- Timestamp + signal_type identifier
- Supplier, vendor, customer, or employee names
- Email addresses, phone numbers, addresses, tax IDs, DUNS
- PO numbers, invoice numbers, monetary values
- Free-text content from any system
- Anything outside our approved categorical schema (defense-in-depth: PII-shaped values are rejected at ingest)
Differential privacy epsilon=1.0 default (Laplace noise calibrated to the metric's sensitivity).
Schema whitelist (only approved categorical filters permitted).
Daily query budget per aggregate definition (12/day default; prevents disclosure-via-iteration).
Every consent change + every aggregate egress recorded in the audit chain.
Customer commits that operator hours reclaimed via AssetShop SCO will not attribute to workforce reduction and is aware of other best use options such as reallocation to sales, innovation, customer service, training, and new-segment expansion. Contractually binding under Section 12.14 of every Founding-5 MSA, with annual self-attestation per Exhibit G.
Bring your hardest security questions.
Every conversation is founder-led. Bring your CISO, your auditor, your procurement security review - we'll answer directly with the evidence under NDA.
What AssetShop is, and what it isn't.
Read-only intelligence platforms surface signals. Customer execution captures value or absorbs risk. This page documents the line between platform responsibility and customer responsibility - explicitly and unambiguously.
01
Not advice. Not execution.
Information only
▸
AssetShop SCO surfaces insights, signals, recommendations, and analytical outputs based on data read from customer source systems. AssetShop is not a registered investment advisor, broker-dealer, financial advisor, legal counsel, accountant, or regulatory compliance authority. Information presented should not be construed as investment, financial, tax, legal, accounting, or regulatory advice.
02
Customer responsibility
Decisions belong to customer
▸
Customer bears sole responsibility for any business outcomes resulting from decisions made based on insights, recommendations, proposals, votes, approvals, or signals surfaced through the AssetShop platform. All hedging, sourcing, supplier-award, capacity-investment, regulatory-disclosure, treasury, financial, operational, and other business decisions remain with the customer's procurement, finance, treasury, legal, compliance, and operations functions.
03
No warranty on insights
Outcomes vary
▸
While AssetShop applies rigorous methodology and discloses every coefficient + benchmark used, no insight or recommendation can guarantee a specific business outcome. Markets shift; suppliers fail; regulations change; data quality varies. The Day-90 Outcome Warranty is a money-back commitment on first captured value documentation - not a guarantee of any specific dollar amount, return rate, or business result.
04
No execution authority
Read-only architectural posture
▸
AssetShop SCO does not execute trades, place hedge contracts, issue purchase orders, bind contracts, modify ERP transactions, instruct treasury operations, or commit the customer to any third-party obligation. All execution remains in customer-controlled source systems on the customer's normal workflow. AssetShop's role ends at surfacing the decision-record; execution is always a customer act.
05
Independent verification required
Verify before acting
▸
Customer is responsible for independent verification of all market data, financial figures, supplier information, regulatory deadlines, certification claims, carbon-emissions data, counterparty health signals, and other analytical outputs before taking action. Engaging qualified legal, financial, tax, regulatory, and compliance advisors for material decisions is the customer's responsibility.
06
Limitation of liability
Boundaries documented in MSA
▸
Master Services Agreement (MSA) Section 11 (Limitation of Liability) and Section 12 (Indemnification) document the precise legal boundaries between AssetShop and customer. Standard SaaS liability caps apply (typically 12 months of fees paid). AssetShop is not liable for indirect, incidental, consequential, special, exemplary, or punitive damages arising from customer's use of platform insights. Customer indemnifies AssetShop against third-party claims arising from customer's business decisions.
07
Confidentiality · MSA Section 10
Customer keeps platform learnings inside the organization.
▸
Customer is obliged not to share AssetShop's proprietary platform features, capabilities, derivation methodologies, calibration insights, configuration learnings, or related operational know-how outside the Customer organization. This includes (but is not limited to): published content, public RFP responses, conference presentations, vendor benchmark comparisons distributed beyond the buying team, social media disclosures, blog posts, podcasts, press interviews, and any other public distribution channel.
Permitted internal use: Customer may use platform documentation freely for internal training, audit-defense preparation, executive briefings, internal RFP responses, M&A diligence rooms (under standard NDA flow-down), and operational reference. NDA-bound advisors and auditors operating on Customer's behalf are permitted recipients under the standard confidentiality flow-down language.
What this protects: the methodology disclosures, signal-derivation explanations, capability descriptions, and parameter-tuning approaches that AssetShop shares with Customers are a competitive asset. Sharing them publicly degrades the protected value all Customers receive. Violations are governed by MSA Section 12 (Remedies). Standard exceptions for compelled disclosure (subpoena, regulatory inquiry) apply with required-notice obligation back to AssetShop.
AssetShop SCO surfaces signals from customer data; customer executes decisions in customer systems; customer bears responsibility for outcomes. AssetShop is not a registered advisor in any regulated category. No specific outcome is guaranteed; all insights require independent verification before acting. Platform methodology + learnings stay inside the customer organization per MSA Section 10. The Master Services Agreement documents the precise legal allocation of responsibility. By using AssetShop SCO, customer acknowledges and accepts these boundaries.