Platform
One tenant, one record model, one trail
Underwrite is delivered as a tenant: your domain, your brand, your generated documents, your keys. Everything below is scoped to that tenant, and nothing crosses between tenants.
underwrite-platform v4.12.0, released 2026-08-27. Placeholder identifiers throughout, demo tenant underwrite-demo.
What a tenant owns
A tenant is not a theme. It is an isolation boundary with its own identity, its own keys, its own document set and its own calendars, and the platform treats it as the unit of both configuration and blast radius.
- Domain and brand
- Your subdomain or your own domain, your mark, your palette. The tenant panel on this site is the same control surface.
- Generated documents
- Disclosure, contract, cancellation notice and dispute templates, carrying your registered values per state.
- Business calendars
- Business day counting resolves against a per tenant, per state holiday calendar rather than one federal calendar.
- Keys and webhooks
- Tenant scoped API keys, a sandbox tenant, and signed events with a per tenant secret.
- Seats and roles
- Seat model with review and despatch separated, enforced at the API rather than in the interface.
- Its own trail
- Every entry, every export and every hash chain belongs to the tenant and leaves with it.
Modules
- MOD-CASE
Case management
Queues, statutory clocks, correspondence, item level outcomes. The surface an operator seat lives in all day.
Open - MOD-CTRL
Compliance engine
Ten controls that refuse an action and name the rule that refused it.
Open - MOD-AUD
Audit trail
Append only entries, hash chained exports, retention by rule.
Open - MOD-DOC
Document generation
Disclosures, contracts and cancellation notices generated from tenant fields, validated for completeness before they render.
Open - MOD-BILL
Billing
Invoicing gated on performance. The processor never sees a charge the engine has not cleared.
Open - MOD-ACC
Access and seats
Single sign on, SCIM provisioning, and the enforced split between the seat that reviews and the seat that sends.
Open
How a request moves through it
Every write passes the engine before it reaches storage, and every write that the engine refuses is still written to the trail as a refusal. There is no path around it, which is the only reason the trail can be used as evidence.
Both outcomes reach the trail. A refusal is evidence too.
Where it runs
Multi tenant by default in a single United States region, with logical isolation per tenant and encryption at rest and in transit. Single tenant data residency is available on the Platform plan by agreement, and the residency choice is recorded on the tenant rather than held in a support ticket.
- Least privilege access with a break glass path that is itself audited.
- Recovery objectives published on the security page rather than quoted on request.
- Your data leaves in the format the trail is written in, not in a summary of it.
