S-04 — Security and Fairness: What We Can Promise and What We Cannot (plain-language guide)
Scope: A plain-language guide to what protections you can check, what we do not claim, and what to ask before you sign. Status: As of 2026-11-09, pilot-ready with Soft mode (Soft mode means the system practices with test examples and does not touch real money or live citizen records until you say so). Blueprint sources: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md; docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md; docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md; docs/jijibora-government-trial/09_MOU_NONBINDING.md; docs/jijibora-government-trial/06_CONTEMPORARY_ISSUES.md; S-01 — Overview (plain language); S-03 — Glossary (plain language); Playbook Registry — What You Can Run, Who Runs It, What You Get Back
What this means for you
This guide tells you exactly which protections you can re-check yourself, such as sealed receipts and locked personal files, and exactly where the honest limits are (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). You will also see what we do not claim, so there are no surprise compliance badges after you sign (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md).
Details
The posture below follows two honesty rules that appear in every source: when something goes wrong the system stops and tells you rather than pretending it succeeded, and it never invents a price, a saving, a signature, or a live status (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: S-01 — Overview (plain language)). The platform describes its own posture as refusing to invent live state and showing honest empty results when data are absent (source: S-01 — Overview (plain language)). The ward trial repeats the same boundary: if phones, power, or server connections fail, the platform stops safely in its last known secure state and never fabricates false success (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md; source: docs/jijibora-government-trial/09_MOU_NONBINDING.md).
1. What we can genuinely claim (and how you can check it)
| Protection | What it means in plain language | How an auditor can check it | Source |
|---|---|---|---|
| Audit trail integrity | Every finished job leaves a sealed receipt chain that records the rule that triggered, who approved it, where the worker was, and before-and-after photos (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). Receipts are linked so a change in one breaks the chain and alerts the auditor (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). | Recompute the chain from step records and compare the head to the recorded head; a matching head means the order was not edited (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). An emergency override shows who requested, who approved, and when it expires in the audit log (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md; source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: S-03 — Glossary (plain language)) |
| Personal-data minimisation | Raw personal names, phone numbers, and addresses are not written into system event messages or receipts (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). General dashboards show only logistics and transport status, not diagnoses (source: docs/jijibora-government-trial/05_IMPLICATIONS_AND_APPLICATIONS.md). No facial recognition is used, and no unconsented surveillance or identifiable patient records are processed (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md; source: docs/jijibora-government-trial/09_MOU_NONBINDING.md). | Ask us to show a sample receipt with no personal names inside the event payload and a dashboard that shows urgency without diagnoses (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/06_CONTEMPORARY_ISSUES.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/05_IMPLICATIONS_AND_APPLICATIONS.md; source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Identity attestation | Sign-in is handled by a separate sign-in service that checks who is calling, and that check is kept apart from rule signing (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). A provider such as a garage, clinic, or artisan can be published only with an attestation signed by the customer's own key, and a missing attestation is refused (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). | Show us the attestation receipt for one listed artisan and a job that was refused because the attestation was missing (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back) |
| Purpose-limited access (selector: servant-consent flows in brief) | Access is given only for the stated purpose and ends after a short time; emergency trip details shared with a responding crew expire four hours after handover and leave the phone screen by themselves (source: docs/jijibora-government-trial/06_CONTEMPORARY_ISSUES.md; source: docs/jijibora-government-trial/10_MASTER_EXECUTIVE_DOSSIER.md). Emergency sharing is limited to scrubbed fields unless a purpose grant exists, and a child case cannot widen the parent limits (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). | View the audit entry that records an auditor read of retained value and the expiry rule for a purpose grant (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). | (source: docs/jijibora-government-trial/06_CONTEMPORARY_ISSUES.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md) |
| Zero-trust encryption (locked files, keys held separately) | Files are locked with strong encryption, each person's file is opened only with their own key held in a secure key store, and erasing that key makes old copies unreadable while the receipt chain stays valid (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Health files use chunked locking with role checks before any view (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). | Review the shred log for one erased key and confirm the chain head still validates while the shredded value no longer opens (source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md) |
| Retention you control | The council chooses whether to keep only the seal, only the value, or both for rule inputs and outputs, and a ward may keep more but never less than the council promise (source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). A legal hold blocks erasure, and an auditor read of retained value writes an audit entry (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). | Show us the retention choice for one receipt and a record where a legal hold blocked a shred (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md) |
If a rule no longer loosens a council promise, the system refuses it at the time it is written and logs the refusal for review (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md). Emergency override needs two people, a short life of one hour by default and never more than 24 hours, and a clear audit record, with no automatic follow-up report created by itself (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Ward supervisors have a phone switch to return all units to manual mode at once during a sudden crisis (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). The privacy vault uses BBS Plus (BBS+ — a privacy method that lets a person prove one fact, such as age or place of residence, without handing over a whole file of private details) so a resident can prove one fact without sharing everything else (source: S-03 — Glossary (plain language)).
2. What we explicitly do NOT claim
| Honest limit | What this means for your contract | Source |
|---|---|---|
| No invented compliance badges | An outside-auditor export is evidence you hand to an auditor, not a certificate, and it is unsigned until the customer's own key signs it (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The posture study says to retire phrases that claim a product is certified or mathematically impossible, and to use only evidence wording such as auditor-verifiable evidence of an authorised action (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). No percentage saving is claimed until a named pilot measures it (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md) |
| No live money in Soft practice | Practice runs show a plan and explain it but do not commit anything real, and a practice pack cannot declare itself live (source: S-01 — Overview (plain language); source: S-03 — Glossary (plain language); source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). The switch to live happens only when real checks answer on the spot (source: S-03 — Glossary (plain language)). | (source: S-01 — Overview (plain language); source: S-03 — Glossary (plain language); source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back) |
| Shared-records honesty (multi-tenant separation) | Councils share one platform with logical separation by scope and realm, rather than separate hardware for each council (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The posture study says that shared-record separation does not meet the highest United States federal security level for large government systems (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). In the ward trial the data still sits in an isolated domain under the Authority's control with full export and deletion on exit (source: docs/jijibora-government-trial/09_MOU_NONBINDING.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/09_MOU_NONBINDING.md) |
| Key-custody honesty | Rule sheets are written in a shared store and the operator can load a changed sheet (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The rule-signing root is not yet held in a customer-held hardware key store, and past code signatures are not required by the loader (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The study says the correct wording today is tamper-evident once the digest is checked, not customer-held keys already in place (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md) |
| No autonomous decisions and no invented data | The system never takes autonomous irreversible actions such as shutting water, closing schools, isolating power, or spending council funds without a named officer's approval (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). It cannot guess a crisis with no gauge, meter, or phone report (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). It does not replace physical engineering inspections or safety certification (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Erasure limits you should know | Erasure uses key destruction so old copies become unreadable while the receipt chain stays valid, with a legal hold able to block the shred (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The later gap review says a prior copied file could still be opened with the old data key, so the limit is scoped rather than absolute (source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). Erasure is therefore described as key shredding, not as full history deletion (source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md) |
| Sharing-record limits | Sharing between councils uses whole-record allow or deny plus an event log with no automatic merge (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The earlier posture note said automatic removal of named fields was not yet available, while the later gap review says named-field removal now exists in code (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). You should ask us to show the removal on your trial ward before you share sensitive fields (source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). | (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md) |
The posture study also states that the export for international quality and security checks is not a certificate and is unsigned by default (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). The study lists similar lines for health records and money holding: health storage has strong locking but no ready-made agreement package for the United States health privacy law, and a money-holding service would need extra licences, so the platform stays non-custodial and orchestrates while a licensed partner holds funds (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). In plain terms there is no United States patient-record custody in year one and no filing service for outside regulators (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Whether you should hold funds through a licensed partner in your jurisdiction is UNKNOWN in the sources until your legal advisor confirms the local route (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
3. How we compare with other kinds of tools (fair comparison)
| Kind of tool | What it does well | What Jijibora adds in plain terms | Source |
|---|---|---|---|
| Everyday housing software for homes and estates (named examples are AppFolio, Buildium, and spreadsheets) | Stores tickets and dues in one place | Turns council and estate rules into active checks, links repairs to escrow proof, and makes small buildings respond to weather in the channel residents already use | (source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md) |
| Large city and utility suites (named examples are Itron and Black and Veatch) | Serve very large cities with full utility systems | Starts at community scale and plugs into phones and messaging instead of replacing the whole city, so a small town can start with one ward | (source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md) |
| Governance reporting tools (named examples are Vanta, Drata, and ServiceNow governance) | Collect evidence for outside statistical and security audits | Can refuse a rule that loosens a council promise when it is written and records each sharing decision, rather than only collecting evidence after the fact | (source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md) |
| Messaging plus spreadsheets used by hand | Fast to start and familiar to staff | Adds sealed receipts that an auditor can re-check without trusting the vendor, so donor and county review starts from proof rather than rebuilt sheets | (source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md) |
The market study sums up the difference in one sentence: housing software stores tickets, while Jijibora makes rules executable, escrow provable, and buildings responsive, headlessly in the channel residents already use (source: docs/jijibora-gtm/01_MARKET_AND_CUSTOMER.md). That comparison is a class separation, not a claim that other tools are unsafe.
4. Trial risk safeguards (from the limits and risks note)
The trial note lists six risks and the built-in safeguard for each one (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md).
| Risk | Severity in the note | Built-in safeguard | Source |
|---|---|---|---|
| Autonomous harm or public damage | High | Automated steps are limited to safe alerts; serious actions need a named officer's approval | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Citizen privacy and data breach | Medium | Privacy by design with no facial recognition; health data stays confidential and expires from phone screens by itself | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| System freeze during a sudden crisis | High | Ward supervisors have a phone switch to return all units to manual mode at once | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Commercial lock-in | Medium | Total data ownership with all rules, contacts, and reports remaining council property in open files | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Favouritism in contractor choice | Medium | Transparent scoring by distance, verified skills, and fair rotation, with public logs | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
| Ghost workers and invoice fraud | High | Milestone holding where no money moves until arrival point and photo proof are approved by the ward inspector | (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md) |
The trial also states that the platform does not resolve labour disputes, pave roads without asphalt, or find water where there are no aquifers, and that it coordinates people and resources rather than replacing physical works (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). The agreement repeats those limits in contract language and adds that neither side is liable for indirect or knock-on losses from the trial (source: docs/jijibora-government-trial/09_MOU_NONBINDING.md).
5. What to ask the audit team before signing
Ask for live checks in your trial ward, not slide promises. Each question below names the proof that would answer it.
- Show us one finished repair receipt and walk us through re-checking its sealed chain with the auditor (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Owner: Audit team with platform home.
- Show us one receipt with no personal names inside the event payload and one dashboard that shows logistics only (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-government-trial/06_CONTEMPORARY_ISSUES.md). Owner: Audit team with platform home.
- Show us who can approve money, that the approver cannot be the requester, and that an inspector must see photo proof before any release (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md). Owner: Audit team with Finance Director.
- Show us what happens when phone networks drop: that the system stops safely, that a manual switch exists, and that no false success is invented (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md; source: docs/jijibora-government-trial/09_MOU_NONBINDING.md). Owner: Audit team with platform home.
- Show us the retention choice for one receipt, how a legal hold blocks erasure, and how an auditor read writes an audit entry (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). Owner: Audit team with legal advisor.
- Show us the evidence export for international standards checks, whether it is signed, and whose key signed it (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). Owner: Audit team with platform home.
- Show us the sharing log for one record shared with another council and, if field removal is used, show the named fields that were removed (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md; source: docs/jijibora-gtm/09_GAP_ANALYSIS_AND_RECOMMENDATIONS.md). Owner: Audit team with platform home.
- Show us the data export format and the 30-day deletion confirmation that you will give us when we exit, with no ongoing charge (source: docs/jijibora-government-trial/09_MOU_NONBINDING.md). Owner: Audit team with Town Clerk.
What to ask us next
- Pick one finished repair and ask us to re-check its sealed receipt chain live with your auditor before you sign. Owner: Audit team with platform team (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md)
- Confirm which retention choice you want for receipts and how legal holds should block erasure in your ward. Owner: Town Clerk with legal advisor (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md)
- Confirm which personal details must stay out of receipts and dashboards, and that no facial recognition or patient records will be processed. Owner: Authority privacy lead with platform team (source: docs/jijibora-government-trial/09_MOU_NONBINDING.md)
- Confirm who holds repair funds in your jurisdiction and who taps Approve on photo proof, and confirm that automatic deductions are not part of the trial. Owner: Finance Director with legal advisor (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/jijibora-gtm/05_PRICING_AND_MONETIZATION.md)
- Agree how you will test the manual switch and the safe stop when networks drop during the practice drills. Owner: Municipal Champion with platform team (source: docs/jijibora-government-trial/08_LIMITS_AND_RISKS.md)