“UplitAU Pty Ltd (ABN 91 680 646 495), by Director Dr Dmitri Tcherkas, declares as at 2 October 2026 how DEMI Capsule and the DEMI Central Registry protect cryptographic keys, payments, and user data across ten specific security and data-handling commitments.”
PropositionsS1: The registered file is hashed in the user's browser and never uploaded; only its SHA-256 is stored. | S2: Up to 6,000 characters of passage text is sent to the Anthropic API to form the Conceptual Core; only its SHA-256 is stored. | S3: User emails are used solely to confirm card orders and are removed server-side from every public view. | S4: Card details are handled exclusively by Lemon Squeezy. | S5: All API keys, the administrator token and anchoring key are held only as Cloudflare encrypted secrets, never in pages, files, chats or registrations; the Director keeps one offline encrypted copy and uses two-factor authentication. | S6: The server sets the price and verifies every payment at source; one payment registers one record. | S7: Anchoring uses a separate low-balance wallet, signs only if the key matches its address, observes a fee ceiling, and never blocks registration. | S8: The owner key is shown once and only its fingerprint is stored. | S9: Public text is screened server-side; known gaps are the main file name, non-Latin text and impersonation. | S10: The planned DEMI plugin and MCP tools are read-only.
ConstraintsApplies to DEMI Capsule and the DEMI Central Registry as operated by UplitAU Pty Ltd (ABN 91 680 646 495) as at 2 October 2026. This is a self-description, not an independent audit and not legal advice. Scope is limited to the ten enumerated claims. Open items not yet resolved include: independent security review, Capsule terms and privacy policy, Privacy Act compliance status, AML/CTF question R1, migration to own domain, and appointment of a second administrator.
MechanismsS1: PARTY (browser-side hashing is not externally observable without audit) | S2: PARTY (API call content is internal; SHA-256 storage could be REGISTERED) | S3: PARTY (server-side removal requires internal inspection or audit) | S4: WEB (Lemon Squeezy public documentation confirms card-handling scope) | S5: PARTY (Cloudflare secret configuration is internal; 2FA status is internal) | S6: PARTY (server-side price and payment verification requires code or audit review) | S7: PARTY (wallet configuration and fee ceiling require internal or blockchain inspection; anchoring transactions: WEB via blockchain explorer) | S8: PARTY (key display logic is internal; fingerprint storage could be REGISTERED) | S9: PARTY (server-side screening logic is internal; known gaps are self-declared) | S10: PARTY (plugin and MCP tool read-only status requires code review; not yet released)
BoundariesThe statement does not constitute an independent security audit, legal advice, or regulatory certification. It does not address Privacy Act compliance (acknowledged open item), AML/CTF obligations (open item R1), or Capsule terms and privacy policy (not yet published). It does not cover data retention periods, breach-notification procedures, or data residency. It does not bind Anthropic, Lemon Squeezy or Cloudflare. Any amendment or resolution of open items should be registered as a new DEMI record citing this UPL as Parent. GAPS: No dates are given for resolving open items; Privacy Act and AML/CTF compliance status are explicitly unresolved; the own-domain migration timeline is unstated; second-administrator appointment is undated.