# Claims review — 0.2.26

- base: v0.2.25
- head: 9ad4096
- surface: sha256:3d282917e33db272d6e8178bd38f780904c45acbb9d3cbf0951de10658f6f2b8
- verdict: pass
- reviewer: Claude (release review before publish)

The release changed one line of claim surface — the README entry for SOC 2 —
and both findings are about that line and the documents it disagreed with. Both
were corrected in `d728039` before this record was set to pass. The review was
blocked while the first one was open, because its answer was a fact about the
product and not a choice of wording.

## Findings

### 1. README.md:672 — SOC 2 listed as deliberately not planned while LIMITATIONS.md said it was on the roadmap

- Claim: README.md:665 opens its list with "**Deliberately not planned**, so nobody waits for it:" and the entry read "**No SOC 2.** It audits organisations that hold customer data."
- Mechanism: LIMITATIONS.md is the document that states what has not been done. LIMITATIONS.md:7 read "No SOC 2. No ISO. No independent penetration test. On the roadmap."
- Why it falls short: the two published documents answered the same buyer question in opposite directions — one said do not wait for it, the other said it was coming. Neither was derived from the other, so both could be current and disagree. This release sharpened it rather than creating it: the entry had been the topic label "**SOC 2.**" and became an assertion under "not planned", an edit made to satisfy the new language-independent SOC 2 rule. Satisfying the guard moved the sentence into a contradiction the guard cannot see.
- Disposition: resolved in `d728039`, and the basis is in the history rather than in anyone's memory: `git log -S "No independent penetration test. On the roadmap" -- LIMITATIONS.md` returns the commit that created the file, on one line with ISO and the penetration test. The roadmap claim was drafting, not a decision. Not planned is the answer, and SECURITY.md already carried the reason: the audit certifies organisations that hold customer data, and the data Conarium governs does not reach us. An independent penetration test is a separate, achievable thing and stays on the roadmap. A follow-on ambiguity was closed in `9ad4096`: the entry sat under "Deliberately not planned" without saying whose certification was absent, which a compliance reader could take as the product being useless for their own audit.

### 2. README.md:672 and SECURITY.md:107 — the absolute "no data reaches us" form the website retracted the same day

- Claim: README.md "We never receive yours." · SECURITY.md "No data reaches us, so there is no vendor to certify."
- Mechanism: the product is self-hosted, so the database and its records stay in the operator's infrastructure. That is what both sentences are about.
- Why it falls short: on 2026-08-17 the identical absolute form was retracted from privacy.html and terms.html, because the website stores a waitlist email, forwards Concierge chat to a third-party model, and keeps host logs. The correction was not to delete the claim but to scope it inside the sentence: "The data Conarium governs — your database and your customers' records — never reaches us." That scoping landed on the two website surfaces and not on the two npm ships. Rule 9 matches "never receive, see, or store your data" and neither sentence is written that way, so no guard would have found it.
- Disposition: resolved in `d728039`, carrying the wording from privacy.html:33 verbatim into both.