SOC 2 or ISO certification
No certification badge or equivalent assurance is represented.
TRUST & PRIVACY RECORD
Trust is a boundary.
Not a borrowed badge.
This record separates the controls operating today from the assurances Provision Review has not earned or does not provide. It is written for a buyer evaluating a narrow founding pilot—not for a buyer being asked to assume maturity that is not there.
01 VALIDATION RECORD
WHAT HAS BEEN OBSERVED
One real practitioner signal, precisely scoped.
01
Formative workflow validation
A practicing accountant completed the controlled historical review flow.
The reviewer reported that the application worked as expected and expressed strong satisfaction with its accuracy. The exercise covered the review experience and its outputs; it was not an audit, assurance engagement, security assessment, or statistical benchmark.
- Workflow
- Completed
- Domain
- ASC 740 review
- Evidence
- Historical scenario
- Authority
- Accountant retained
CURRENT OPERATING CONTROLS
What the founding-pilot boundary actually does.
These are product and process statements, not substitutes for an independent security certification.
BoundaryCurrent stateMeaning
Public inquiryBrowser-to-emailNo website submission endpoint or file upload
Workspace identityCloudflare AccessIdentity checked before private-workspace entry
Application hostCloudflare WorkerPrivate application boundary on the owner-controlled account
Pilot recordsD1 + R2Account-owned structured records and controlled artifacts
Model inferenceDisabled by defaultNo paid model call is required for deterministic review controls
Source systemsNo write accessNo posting authority to ERP, ledger, or workbook sources
Accounting authorityNamed accountantThe reviewer accepts, requests, escalates, and concludes
02 PILOT DATA FLOW
SEPARATE PUBLIC INTEREST FROM PRIVATE EVIDENCE
Nothing confidential belongs in the first request.
- 01Public fit check
Business contact details and a high-level objective stay in the browser until the visitor chooses to send an email.
- 02Scope confirmation
Readiness, authorization, confidentiality, participants, and the historical-period boundary are agreed before evidence intake.
- 03Private access
Named participants enter the private workspace through the configured identity boundary.
- 04Controlled review
Evidence is inspected without posting to the source workbook, ledger, ERP, or provision system.
- 05Reviewer closeout
Findings, missing support, and actions are presented while the named accountant retains the conclusion.
CLAIM CONTROL
What Provision Review does not claim today.
Early products earn trust by marking the edge of their evidence, not disguising it.
Independent security assessment
No penetration-test or third-party security report is represented.
Enterprise-scale performance
Current practitioner validation does not establish production-scale availability or throughput.
Automated accounting conclusion
The product does not replace professional judgment, tax advice, sign-off, or an assurance opinion.
03 PUBLIC-SITE PRIVACY
PLAIN-LANGUAGE NOTICE
The website asks for less because it needs less.
Do not submit client names, amounts, credentials, workpapers, or provision packages through this public website.
The pilot answers remain in the active browser page until the visitor chooses to open and send the prepared email.
After the visitor sends the message, their email provider and Provision Review's receiving providers process that correspondence.
Optional campaign parameters in the page address may be placed into the prepared email so the inquiry source can be understood.
Hosting and security providers may process standard connection metadata needed to deliver and protect the website.
Any private evidence intake, retention, permitted use, and closeout obligations must be documented before a paid pilot begins.
Effective
This is a public-site transparency notice, not a data-processing agreement or professional opinion.
pilot@provisionreview.comCONTROLLED FOUNDING PILOT