Project and organisational authority
The project determines what matters. The organisation determines what should be retained. Harvux's approved governance model keeps those decisions distinct.
Clear authority. Traceable delivery context.
A procurement conversation should distinguish how delivery knowledge is governed from how access, infrastructure and contractual obligations are assured.
This page presents the approved governance model and available product evidence. It does not treat a marketing description or screenshot as verification of security enforcement.
Different decisions. Different authority.
Review authority
An Observation does not automatically become a Lesson. Evidence is reviewed across projects before it is retained as organisational knowledge.
Decision history and provenance
Connected Records preserve delivery context. The authentic Evidence & Relationships view shows supporting observations, recurrence evidence and project exposure for a published lesson. It is product evidence, not proof of a tamper-proof or comprehensive security audit log.
These are the approved delivery-governance principles, not a claim that every underlying permission or infrastructure control has been independently verified.
Verify access against your operating model.
Role-based permissions
Confirm the permission matrix for your organisational and project roles, including who can capture, review, publish and change records.
Project-scoped access
Confirm how project membership restricts access to records and which organisational roles can review information across projects.
Workspace separation
Request implementation evidence for workspace boundaries and isolation enforcement. This page does not assert a verified tenant-isolation control.
Temporal and project access
Confirm access expiry, reassignment and revocation behaviour where required by your delivery model. Time-bound access is not represented here as a verified capability.
Review and audit authority
Confirm approval permissions, recorded changes, retention and export coverage. Delivery history should not be assumed to provide an immutable security audit trail.
Data and AI handling
Confirm the applicable providers, data flows, retention, training use and processing locations. No hosting, residency or provider-handling assurance is made on this page.
The following are assessment topics, not a list of certified or independently substantiated controls. Review them with Harvux before relying on a particular access or data-handling requirement.
Assistance is not authority.
The supplied mobile Observation capture evidence shows voice input and optional writing polish. The approved knowledge model keeps review separate from capture and drafting.
These product workflows do not establish provider retention, training use, residency, isolation or fail-closed behaviour. Those details require separate implementation and contractual evidence.
Product behaviour is not a contractual commitment.
Hosting locations, data residency, service levels, incident notification, export obligations and ownership terms must be confirmed in the applicable agreement and supporting documentation.
No certification, third-party penetration test, SLA or delivery date for a security roadmap item is claimed here.
Start with the authority and assurance your organisation needs.
Request a briefing