Private by default. Explicit at every boundary.

Research starts private. Public pages and the marketing graph use anonymous database reads; drafts, private event details, tokens and model receipts stay out. Row-level security controls access to every exposed table.

Two publication rules

Every contributor signs off, and the required reproduction data and code are linked or an explicit exception is recorded. Browser-held author keys and an organisation countersignature bind the canonical published version. Corrections create new versions.

Local AI with limits

Unpublished content remains local unless explicit per-item consent allows otherwise. Suggestions carry model provenance and require human review. AI alone cannot take a part above rung 3. Simulated verification evidence is labelled and is not scientific confirmation.

A local prototype

This build uses local Supabase and fictional partners. Future hosting assumes an EU region. Hosted operation, real identities, credentialed provider acceptance, retention governance, independent security review, reliable backups and production monitoring remain release gates.