Security, confidentiality & liability

Your payload data never transits us. The current offer is read-only, in your own tenancy, and asks for no purchasing authority at any stage. The wider access in the second table is what execution would need, and execution is earned, not sold.

In the current offer	What we can do	What we cannot
The record	Read-only on the bill, the contracts, the order forms, and the budgets, in your tenancy, control plane only, with deletion terms in the engagement letter	Nothing that can sign, amend, or pay anything
The desk, watching	Read-only on the scheduler’s job logs, once you grant them	Nothing that can start or stop a job. Nothing that can place an order
Verification pilot	Run an agreed test on an allocation you have approved and paid the supplier for directly	Nothing outside the named allocation and window
Purchase decision	The same read-only access, for one reservation, commitment, or renewal	The same
Access	Scoped read-only credentials your security function issues — the billing export, the contract repository, the budget system — with SSO, roles for the three seats, your keys where your cloud supports them, and an audit log you can export	No write path to any of your systems. The record is the one thing written, to a store in your tenancy that you hold. No cluster-level or organization-level credential
Models on your data	Where a model helps extract a contract or match an invoice, it runs in your tenancy or under zero-retention terms you choose, and nothing trains on your data	No prompts, weights, or customer data; payloads never transit us

Not offered today	What it would need	What it would still not get
The desk, acting Earned	Scoped job submission on named queues and purchase calls to named suppliers, inside a written delegated authority with an approval threshold, a concentration cap, the qualified panel only, your regions, and a named project budget — after a full watch, accepted delivery and liability terms, and written permission from each supplier whose products the desk would order	Cluster-admin. Organization-level billing. Anything above the limit, which stops and waits for a named human. Any order at a supplier whose terms bar third-party purchasing — AWS Capacity Blocks — which the desk prepares and you submit
Settlement Last	Paying suppliers on measured delivery, with the credit and collateral machinery built first	Not offered until the desk has acted for real

Your rates and your contracts are the sensitive asset

Not your weights. Your negotiated rates never inform a cross-customer benchmark or an index, which means our forward view does not improve as we add customers. That is a deliberate trade and we will not quietly claim both.

Bring your own contracts

A supplier becomes eligible only once you have executed the master agreement, the data processing agreement, and the security review. An unqualified supplier cannot be selected at any price. Security approves every supplier, every region, and every access path, and nothing routes around them.

Immutable audit, in your tenancy

Every decision and every change to a contract or a budget is written append-only to storage you own, with who, what, when, and why. We hold a copy; you hold the original. Deletion terms are in the engagement rather than in a policy page we can change, and the whole record exports.

Controls evidence, by gate

A company that has not yet run anyone’s real data and asks to read your contracts owes you the evidence before the money, not after. Each gate is a condition of the next step, written into the engagement.

Before	What exists	What it covers
Anything connects	The architecture, the data-flow diagram, the IAM scopes requested, the subprocessor list, and a mutual NDA	Your security review has what it needs to say no
The first paid subscription	A SOC 2 Type I report and an independent penetration test	The controls exist as designed on the day they are tested
The first renewal	SOC 2 Type II; source escrow; a written wind-down runbook; a second person who can run an engagement without the founder	The controls operated for the period; the record survives us
Any write path	A second penetration test, your accepted security review, and a written delegated authority	Execution, if you ever buy it, starts from evidence you accepted

Until the first gate is passed, the two smaller starts — a back-cast on a redacted purchase, or a sandbox record built from redacted exports — need no credentials at all; see how to start.

Who pays your adviser

The question that resolves most of this market. Ask it of us as well.

Who	Who pays them	What that means for your advice
Broker or compute desk	The seller, or a share of the deal	Advising you to stay put earns nothing
Reseller or channel advisor	Margin on the capacity you buy through them	Their recommendation and their revenue point the same way
Marketplace or auction	A take rate on what clears	Optimizes for a trade, not for your baseline
Serverless or inference platform	The spread between what they pay and what you pay	You never see the supplier’s price at all
Commitment optimizer	A share of the savings it reports	A reason to flatter the number, inside one cloud
Novation	You. Only ever you.	No fee, rebate, referral, or margin from any seller, ever

And the same question, asked of the price layer. Every index administrator in this market now has a commercial stake in a place where compute changes hands — Compute Desk runs the settlement layer, Silicon Data’s chief executive also runs Compute Exchange, a marketplace, and Ornn operates its own marketplace beside its index — and the one furthest along operates the delivery layer as well. Novation administers no index, trades nothing for its own account, and holds no capacity. We say that structurally rather than as an accusation — they are on the other side of the same trade, and a buyer will often want both.

Buyer-paid is a structure, not a guarantee. A fee tied to reported savings would still give us a reason to flatter them, so the subscription is flat and the alternative is agreed with you before the decision rather than after it. Excluded at the start, deliberately: validated pipelines, clinical inference, and anything touching protected health information.