Trust & Security

An institutional visitor will not hand over a file, even a non-confidential one, to a product that has not first explained what happens to it. This page explains that, plainly.

Confidentiality

The complimentary web verification is intended for non-confidential, historical, or already-closed models -- never a live, sensitive deal. State this to yourself before sharing a file: if a model is still commercially sensitive, it does not belong in this flow.

Data handling

Two distinct postures, never blurred. The complimentary web verification runs in a cloud-hosted evaluation environment, once, on a file you choose to share for that purpose. OXXON VERIFY Professional runs entirely within your own infrastructure, with nothing transmitted to OXXON VERIFY's servers as part of a normal verification run.

Upload lifecycle

The verification workflow described on this page is not yet available on this website. When it is, an uploaded file is parsed, verified, and used to render your results and nothing else.

Temporary storage

The uploaded file and every derived artefact -- the parsed model, the sealed record, the rendered preview -- are held only long enough to serve the results screen and any results-email link, then purged on a fixed 72-hour retention window.

Security principles

The same model, verified again, produces the same result. Every verification is sealed to an immutable record, identified by its own sha256 content hash -- this result cannot be silently altered after the fact.

Scope of verification

OXXON VERIFY checks cross-statement source-tie integrity, internal arithmetic integrity, and restatement consistency, deterministically, against a model's own figures. It does not assess commercial merit, market assumptions, or whether a model represents a good investment.

Claims boundaries

OXXON VERIFY's conclusion is not an audit opinion, not a regulated assurance engagement, not investment advice, and not validation of commercial or market assumptions.

Cloud evaluation environment posture

No encryption-at-rest posture beyond standard TLS in transit, no data residency commitment, and no SOC 2/ISO certification exists today for the cloud-hosted evaluation environment. This is stated here plainly, not implied otherwise by this page's tone, and must be resolved before the free flow processes any real institutional visitor data.

Governed-text discipline

Every sentence of conclusion, limitation, and metric text in an OXXON VERIFY report traces to a registered, reviewed text id -- no report sentence is freehand-typed at generation time. Here is one, exactly as it renders in every report, next to its registered id: