Data ownership
TENANT · 1 RECORD · 1 GATEYours. Isolated. Provable.
What you capture is yours, and what the platform measures from it is yours. It is held on its own, read only through a gate that checks permission before the read, and every read is written down where you can go and look at it.
The boundary
Ownership, drawn as a boundary.
A record that outlives its projects is a title, so it is worth drawing like one: a closed boundary with a control point on every corner, the four properties that make it a boundary written along the edges, and exactly one gate.
- OWNERSHIP · YOURS · STATED IN CONTRACT
- ISOLATION · ONE TENANT · ONE RECORD
- PERMISSION · ONE GATE · DOWN TO ONE ZONE
- AUDIT · EVERY READ LOGGED · YOURS TO QUERY
The gate is the same one a program comes through: permission is checked before the read, down to a single zone, so GR Brain and any token you issue see exactly what the person holding them can see — never a filtered version of more.
Outside the line
What therefore does not happen.
Anyone can say the data is yours. The load-bearing half of an ownership statement is the list of things that therefore do not happen — and it is short enough to check in one sitting.
Benchmarks are the one thing that could ever cross, so they are drawn outside the line on purpose: they exist only if you opt in, are computed across organizations that also opted in, and never carry a site, a supplier or a figure back to the record it came from. Nothing about your sites moves because somebody else asked a question.
- POOLED CORPUS · NONE
- TRAINING ACROSS CUSTOMERS · NONE
- YOUR RECORD INSIDE ANY MODEL · NONE
- SECOND COPY OUTSIDE YOUR TENANT · NONE
- ATTESTATIONS · NONE YET · SAID PLAINLY
One record. Every phase. Decades. All of it on your side of the line.