Public assurance

Trust starts with a clear boundary.

This centre describes the controls visible in the current website and the commitments Kaizen can support today. It also names what has not been independently verified or contractually promised.

Current position

Assurance at a glance

Website architecture: Next.js on Vercel, PostgreSQL on Neon, and requested transactional email through Resend.
Optional measurement: First-party site analytics remain off until the visitor chooses them. Prior research-improvement tracking is disabled.
Accessibility target: WCAG 2.2 Level AA is the engineering target; independent certification is not claimed.
Availability: No public real-time status feed or default contractual uptime guarantee is currently asserted.

Follow the evidence

SecurityImplemented controls, known assurance limits, and private reporting.PrivacyInformation purposes, choices, retention boundaries, and individual rights.SubprocessorsProviders, purposes, information categories, locations, and change notices.AccessibilityWCAG target, current measures, known review areas, and barrier reporting.StatusWhat public service-state evidence is and is not currently available.SupportIntake, severity, service window, response targets, and escalation.Company & procurementDelivery capacity, engagement stages, contract boundaries, and evidence limits.Website termsGeneral website and prior-research terms; customer terms require a signed agreement.

Current public application

How website information moves

1. Visitor and browserPublic pages load; optional analytics stay off until affirmative consent.
2. Vercel application layerPages and protected routes validate requests before a workflow continues.
3. Neon persistenceValidated submissions and operational records are stored only where the feature requires it.
4. Requested email pathResend handles transactional delivery; Google Workspace handles operational correspondence.
5. Restricted operationsAdministrative views and scheduled jobs use server-side authentication and are not public data feeds.
6. Source and change controlsGitHub holds application source and automated checks, not ordinary website form records.

This is a service-level view, not a complete network diagram. Provider account settings, backup topology, and customer-specific integrations require a scoped review.

AI-use boundary

The current public website does not contain a generative-model runtime that sends contact, prior research, or comment contents to an AI provider.
The paused project's prior scoring and recommendations were deterministic application rules and directional decision support, not automated approval, certification, or a legal decision.
For professional services, any third-party AI use, permitted information, human review, ownership, and deletion expectations must be defined for that engagement.
Website submissions are not intentionally used by this application to train a public foundation model.

What is not claimed

No SOC 2, ISO/IEC 27001, ISO/IEC 42001, PCI DSS, or other formal certification is claimed.
No independent penetration test, accessibility certification, or legal review is claimed here.
No default 24/7 support, uptime SLA, recovery-time guarantee, or Canada-only processing promise is made.
Provider controls do not replace Kaizen's own review, and a green automated check is not proof of production availability.

Ask for engagement-specific evidence

Send the questionnaire, security schedule, data-location requirement, insurance request, or procurement deadline to info@kaizenstrategic.ai. Kaizen will distinguish a confirmed control from a planned control and will not silently convert this public summary into a contractual promise.

Bringing the work into view.

This should only take a moment.

Loading the requested page.

Assurance at a glance

Website architecture

Next.js on Vercel, PostgreSQL on Neon, and requested transactional email through Resend.

Optional measurement

First-party site analytics remain off until the visitor chooses them. Prior research-improvement tracking is disabled.

Accessibility target

WCAG 2.2 Level AA is the engineering target; independent certification is not claimed.

Availability

No public real-time status feed or default contractual uptime guarantee is currently asserted.

How website information moves

1. Visitor and browserPublic pages load; optional analytics stay off until affirmative consent.
2. Vercel application layerPages and protected routes validate requests before a workflow continues.
3. Neon persistenceValidated submissions and operational records are stored only where the feature requires it.
4. Requested email pathResend handles transactional delivery; Google Workspace handles operational correspondence.
5. Restricted operationsAdministrative views and scheduled jobs use server-side authentication and are not public data feeds.
6. Source and change controlsGitHub holds application source and automated checks, not ordinary website form records.

This is a service-level view, not a complete network diagram. Provider account settings, backup topology, and customer-specific integrations require a scoped review.

AI-use boundary

The current public website does not contain a generative-model runtime that sends contact, prior research, or comment contents to an AI provider.

The paused project's prior scoring and recommendations were deterministic application rules and directional decision support, not automated approval, certification, or a legal decision.

For professional services, any third-party AI use, permitted information, human review, ownership, and deletion expectations must be defined for that engagement.

Website submissions are not intentionally used by this application to train a public foundation model.

What is not claimed

No SOC 2, ISO/IEC 27001, ISO/IEC 42001, PCI DSS, or other formal certification is claimed.

No independent penetration test, accessibility certification, or legal review is claimed here.

No default 24/7 support, uptime SLA, recovery-time guarantee, or Canada-only processing promise is made.

Provider controls do not replace Kaizen's own review, and a green automated check is not proof of production availability.