What our operating model is designed to support, how engagements are scoped, how the platform assistant handles your messages, and how a purchase becomes a delivered artifact. Where something is not yet in place, this page says so.
Control alignment
Each row is how the design, records, and delivery practice answer that control family. Engagements are then scoped to the control set your program actually inherits.
What this is not. Alignment describes how the operating model is designed and documented. It is not a certification. We do not claim FedRAMP authorization, CMMC certification, or a completed SOC 2 examination. If your program requires one of those, diligence will say exactly what is and is not in place before you commit to anything.
Environment scoping
Controls only mean something when the boundary is explicit. Every engagement starts by naming the environment and the data classes inside it.
Synthetic fixtures only. Demonstration runs, sample audit records, and preview environments never contain mission data, customer records, or credentials.
Each engagement is scoped to the systems, data classes, and policies named in the statement of work, with the reviewer and approver identified before build begins.
Credentials and infrastructure ownership pass to your team at handover. Our access ends when the engagement ends, and the runbook records how it was held.
Boundary rule. Defense research, mission telemetry, and customer records stay in their own environments. Marketing assets, demo environments, and assistant conversations never carry them.
Assistant governance
The assistant is a product-information and routing surface. It does not perform purchases, approve work, or act on any system on your behalf.
Delivery model
A checkout redirect proves nothing. Delivery is granted only after our payment webhook verifies the signature and the charged amount against the server-side order.
Order created
Price, currency, and scope resolve server-side from our catalog — the buyer never sets them.
Payment verified
The signature-verified webhook confirms a paid status and a matching amount.
Artifact released
The order is marked delivered and a private, token-gated page is issued to that buyer only.
Receipt and record
A confirmation email carries your receipt and the delivery link; the purchase record is retained.
When it arrives
Digital products and module packages are released within minutes of confirmed payment. Engagements begin at the kickoff slot booked after purchase.
What is included
Each product page states the exact scope: what is delivered, in what format, and any usage capacity that comes with it.
If the link does not arrive
Open the contact page with the receipt address and purchase date. We reissue the delivery page to the verified buyer.
Refund terms, the cancellation path for monthly plans, and the dispute process live in the refund policy, alongside the terms of sale.
Counterparty identity
Procurement and legal review need a named counterparty. These are the current details of record for Codex Immortal.
Before you sign anything
The diligence dossier adds the registration certificate, insurance limits, subcontractor list, and the data-handling addendum your contract vehicle expects. Request it from the contact page and it is routed to the principal directly.
Request the dossierResponsible disclosure: report a suspected vulnerability through the contact form and we will confirm receipt, scope the report with you, and tell you what changed.
Bring your control set and review checklist. We will answer each item in writing before any engagement starts.
We use local storage and caching to keep the platform fast and reliable. No third-party advertising trackers. See our Privacy Policy.