Help

Records receipt, identity confirmation, extensions and clarification, and computes the statutory deadline.

Implements the corresponding-date rule with its short-month fallback, weekend and bank-holiday roll-forward, and the distinction between clarification of scope (which stops the clock) and of response format (which does not).

Names every individual in the case with their role and capacity, and drives consistent treatment across the whole pack.

Capacity is held separately from role because the professional exemption turns on official capacity, not job title.

The same machinery against the FOIA exemption set.

Planned. Policy packs are data, so this is a new pack rather than a new product.

PDF, Word, Excel, PowerPoint, OpenDocument, images and plain text, identified by content rather than by filename.

Office formats are converted by LibreOffice; pagination may differ from the originating application, and Bates numbering governs the bundle.

Finds content a reviewer could not see on screen and puts it in its own queue, naming the mechanism that concealed it.

Covers optional-content layers that are off, white-on-white text, zero-size text, off-page content, annotations, tracked changes, comments, vanished runs, document properties, hidden worksheets, hidden rows and columns, and pivot caches.

Recognising text in scanned pages so they can be searched and reviewed.

Planned. The recognition engine is already in the product and runs on every release, where it reads the rendered pixels to prove a redaction really removed what it covered. Attaching a recognised text layer to a scanned page at ingest, so a reviewer can search it, is not yet built: pages with no text layer are surfaced for manual review instead.

Cursive and handwritten contact notes.

Planned. No open-source engine reads unconstrained handwriting usefully; this requires a cloud service with UK data residency, and until it is built handwritten pages route to a manual review queue.

Each licensed organisation's data is separated by PostgreSQL row-level security, not by application code remembering to filter.

Every tenant-scoped table carries its own tenant identifier and a policy with both USING and WITH CHECK, under ENABLE and FORCE ROW LEVEL SECURITY. The service connects as a role that owns nothing and holds neither BYPASSRLS nor superuser, and the tenant is set per transaction with SET LOCAL, so it cannot survive onto the next request that borrows the connection. With no tenant established every policy predicate is NULL and nothing qualifies -- it fails closed. A query that forgets its WHERE clause returns nothing rather than somebody else's case.

Deleting a case destroys its content and its files on disk, and leaves the record that the deletion happened.

Erasure and auditability pull against each other, and the resolution is that they hold different things. The audit trail keeps metadata, hashes and a narrative of what was done, and has no foreign key to the case so that it outlives it. Its entries CAN name the data subject and third parties -- a case entry reads "Confirmed 'C. Rothwell' as a form of ..." -- and those fields are withheld from any caller who does not hold case-content permission. Afterwards the council can show who deleted what and when. Restricted to an approver; a reviewer is refused.

Records reads as well as writes, and detects alteration or removal of a historic entry.

Each entry is hash-chained to its predecessor, so altering or removing a historic one invalidates every hash after it and the verifier names the sequence where the break begins. The verifier is itself tested by corrupting an entry and requiring it to report the break -- an integrity check that has only ever shown green is not evidence of anything.

The assurance tier can be switched off per tenant; the system still completes a case without it.

Every egress is logged with provider, model, region, purpose and the redaction state of the content when it was sent.

Sign in with your own organisation's Microsoft directory.

Authorization code with PKCE, state and nonce; the token's signature, issuer, audience, expiry and nonce are all checked against the signing keys of the directory that issued it. Which Vellum tenant a person belongs to is decided by that directory and never by their email address -- an address proves nothing about who issued the token -- and an operator sets the mapping, so a sign-in can never create one. Personal Microsoft accounts are refused three separate ways. Accounts are never provisioned automatically: a directory identity with no account is refused and told who to contact, because a directory holds everyone who works somewhere and these are case files.

Adding people, changing their roles, switching an account off and removing it, from inside the product.

GET/POST /api/members, PATCH and DELETE /api/members/{email}, all gated on user_manage, which only the administration role holds -- and that role holds no case-content permission, so the person who manages accounts cannot read case files. Roles come from the council's own authorisation namespace rather than a list compiled into the product. Every change ends the target's sessions and invalidates their cached permissions, because a changed role with a live cookie is not a changed role. A change that would leave the council with nobody who can sign in and manage accounts is refused, since there is no way back through the product. Removal takes away the membership and keeps the identity, so a consultant working two authorities is not erased from both; re-adding them restores access with a new passphrase.

Every candidate carries the detector, its version, and the rule or checksum that caused it to fire.

Confidence is shown as one of three bands with a stated evidential basis, not as a percentage we cannot calibrate.

A name confirmed once is applied identically to every document, and the result is reproducible byte for byte.

Similarity proposes aliases for a human to confirm; only confirmed forms are applied.

Records each step and each factor weighed, not only the conclusion.

A record of the conclusion alone is not a defensible record of a balancing exercise.

A second opinion over the already-redacted rendition, returning findings for a human rather than edits to a document.

Runs after the deterministic tier, over the rendition as it would be released, and is measured by what it CATCHES rather than by what it changes -- it cannot edit a document, and a finding it raises is a candidate an officer still has to decide. Every run carries its own control: a known-positive document with planted items it must find, and a planted instruction it must refuse to follow, both reported with the run. A run whose control did not hold is marked as such rather than presented as a clean result. Findings are anchored verbatim to the text at their offsets, so one that quotes something the document does not contain is discarded rather than shown. It can be switched off per tenant, and a case reaches a verified bundle without it.

Checks the finished bundle by independent paths, after first proving the checks can fail on deliberately dirty controls.

A suite that has never produced a positive is not evidence of a negative.

Archival-format bundles validated before release.

Planned. PDF/A-2b rather than 3b, because PDF/A-3 permits arbitrary embedded attachments.

Removing text from the content stream while keeping the page vector.

Planned. Current output rasterises only the pages carrying a redaction, which is provably irreversible; vector mode is a fidelity improvement, not a correctness one.