Every outbound action. Every piece of your data involved.
Not a log buried in settings. A sealed, append-only record of what left this machine, who received it, why, and what was deliberately withheld.
Decision trace
Not a log buried in settings. A sealed, append-only record of what left this machine, who received it, why, and what was deliberately withheld.
What holds
The difference
A privacy policy says what could happen. This says what did.
Every departure is written before it leaves and chained to the one before it, so the order cannot be rewritten quietly - which is a stronger guarantee than a git branch, because a branch can be forced. (egress.ts, store.ts)
What went, field by field
Not "contacted a supplier". Your name and the order reference, and nothing else, itemised.
What was held back
The honest half of the same record. A field withheld is recorded beside the fields that travelled, because a list of what went is only half an answer.
What they do with it afterwards
None, unknown, or retains - and "unknown" is its own answer rather than being rounded down to "none".
How much conversation travelled
A different kind of disclosure from a field, so it is counted separately rather than folded in.
How it goes
From declaration to record, in four moves.
It declares before it goes
A parcel names its fields up front. Anything undeclared cannot be in it.
The gate reads the declaration
Minimal disclosure is enforced against that list, not against intent.
The trip is written down
Sealed into the chain, with the destination, the purpose, and the fields.
You read it whenever you like
In the command centre, under "Data out".
Before anything leaves
An empty record is a claim in itself. It means nothing has left.
This ledger does not start with a summary of what might happen. It starts empty and grows only when something actually crosses the boundary, which is what makes a line in it worth reading.
Nothing has left this machine
Every outbound message, lookup and call is written here with the exact fields that went and who received them. There is nothing to show yet.
What it holds to
Four things the record will never do. Including for us.
It never says "contacted a vendor"
That is a summary, and a summary is where the detail you needed goes missing.
It never edits an entry
Append-only, and each entry sealed against the last. Correction is a new line, never a rewrite.
It never omits a refusal
What it declined to do is its own section. An agent whose refusals are invisible is indistinguishable from one that never refuses.
It never leaves you guessing
If something went out, it is in the record. If nothing did, that is what the record says.
The rest of the workbench.
Decisions arrive with the work done, not the questions still open.
Context that stays warm after the meeting, the email, and the tab close.
Meet the chief of staff your company never had.