FICTIONAL PORTFOLIO / UPDATED OCTOBER 23, 2026
Privacy & Trust
Clear records. Clear boundaries. This demonstration uses fictional manufacturing information and records human review before operational commitments.
What is saved and who can see it
Cloudflare D1 retains identity identifiers, memberships, fictional orders and materials, supplier evidence, inspections, lot/certificate references, packing/delivery fixtures, financial/procurement records, saved guide exchanges and audit/access metadata. Optional Clerk links retain verified identity mappings. Each workspace has its own records; customer and supplier projections, search, calendar and completion packets use server-enforced resource scope. Documents are reference metadata, not uploaded or authenticated files. Do not enter real confidential, payment-card or sensitive personal information.
Sign-in and workspace access
Company pages are public. Private APIs verify a Sites identity or an enabled app-specific Clerk session, then check current workspace ownership, membership and customer/supplier resource scope. A perspective selector never grants access. Clerk checks the configured issuer, authorized app origin/party, signature, expiry and active provider session; audience is checked when configured. Linking an existing owner requires both verified identities and an audited mapping. Uninvited sign-up grants no existing workspace. The development integration does not establish production readiness or MFA enforcement.
Implemented browser and server protections
Implemented controls include parameterized queries, strict fields/dates, bounded requests and source reads, request limits, write-origin checks, revision compare-and-swap, event idempotency, private/no-store responses and restrictive browser headers. Source research refuses arbitrary URLs and redirects; imported text is untrusted. Audit histories retain review evidence. The CSP permits framework-required inline scripts and explicit configured provider origins; it is not nonce-only. These controls are not a guarantee against every attack or an independent audit.
Hosting encryption and its limits
Hosted connections use HTTPS. Cloudflare documents automatic AES-256 encryption at rest for D1 and TLS in transit. These are provider-documented hosting protections, not an independent Ironwood audit or application-managed encryption. The server reads records to serve the app, so this is not end-to-end encryption. No separate application encryption key or compliance certification is claimed.
Cloudflare’s D1 data-security documentation ↗AI, audio and external sharing
Hosting and identity providers process service and verification requests. Separately enabled, reserved owner-only OpenAI guidance sends bounded authorized fictional context and a question; optional transcription submits at most 15 seconds of microphone audio after explicit action, without server audio retention. Reserved ElevenLabs playback sends only the displayed authorized excerpt, up to 80 characters, using selected Bill; sample audio and its receipt may be retained. Each has a separate retained lifetime permit; uncertain outcomes are not automatically retried. Public demos cannot invoke paid AI or voice. Browser speech recognition may use its browser provider after a microphone click. Private supplier research reads allowlisted official pages; public research uses fixtures. This local security guide sends nothing externally.
Public demonstrations and cookies
The public demo uses a random 256-bit cookie scoped to /api/demo, HttpOnly and SameSite Strict, with Secure on HTTPS; only a token hash is saved. Each cookie maps to a separate synthetic workspace and actor with 24-hour expiry. Expired workspace, snapshot and access rows are cleaned on a subsequent demo request, not by an exact-time deletion job. Creation is capped at 48 active sessions and 10 sessions per hashed client-IP bucket per hour. Requests, mutations, storage and snapshots are bounded. Demo perspectives never select private workspaces or grant real memberships, purchases or paid provider use.
Cards, procurement and financial evidence
No card-number or CVV collection is implemented. Saved-method brand/last4 and Pay outcomes are clearly synthetic fixtures; a fixture signature never authenticates actual settlement. Quotes, PO commitments, accepted receiving, FIFO inventory basis and material-subtotal payables are separate from settled cash. Shipping, tax and fees require explicit actual-charge allocation. Customer payment claims never confirm funds. Unknown payment fixtures retain their reservation until audited owner reconciliation. Real supplier checkout, vaulting, charges and banking/payroll/accounting connections remain disabled. Future execution needs supported hosted collection, merchant/supplier compatibility, reviewed accounts/terms/fees, signed real receipts and an explicitly authorized actual order. No token is a universal supplier card.
Retention, export, recovery and deletion
Private records have no automatic deletion schedule or self-service permanent erase control. Owners can export authorized JSON and financial reports and save up to 10 recovery snapshots; public demos allow 3 snapshots and expire after 24 hours. Restore pauses automation, cancels restored outbound work and preserves current audit/idempotency, financial, procurement and fulfillment histories with dependency checks. Membership and provider permits do not roll back. Request retention/deletion maintenance through the original Ironwood Codex build chat. Deleting an export or browser draft does not erase hosted records. Infrastructure logs and provider backups may have separate retention. Backup completeness, deletion from backups and guaranteed recovery time are not independently verified.
Limits, concerns and production readiness
Ironwood is a fictional manufacturing portfolio. Live email/SMS/calendar/carrier execution, machine control, customer file upload/malware scanning and complete accounting synchronization are not active. Document references do not prove authenticity, and synthetic production or delivery is not real fulfillment. No PCI, ISO, HIPAA or other compliance certification, independent penetration test, incident-response SLA, MFA enforcement or recovery guarantee is claimed. Provider fees, model access, commercial rights, production identity/domain readiness and live onboarding need separate verification. Report a concern or request owner maintenance in the original build chat; this local guide cannot submit a report.
Identity and domain setup status
A separate development Clerk application is prepared for this business. Existing Sites recovery remains available; email alone never transfers ownership. No new paid account entitlement was provisioned in this app. Domain purchase and mapping are managed separately by the coordinator; production DNS/TLS and identity acceptance require their own verification.