Data Sources and Compliance Boundaries

Trust work is only credible if its own inputs are clean. This page states the boundaries FactRelay operates inside — they are engagement terms, not aspirations.

Data we use

• Client-authorized public materials: your website, documentation, trust pages, and other materials you direct us to;
• Declared measurement surfaces: authorized APIs (e.g. OpenAI Responses API web search), client-authorized first-party data (e.g. Search Console), and manual, disclosed sampling of consumer interfaces where terms permit;
• Public sources cited by answers: fetched for verification, recorded with dates and versions.

Data we refuse

Customer lists, chat logs, contracts, credentials, identity documents, database exports, and non-public commercial material. Engagements are designed so this data is never needed. Where a client offers it anyway, we decline it.

Platform respect

• No scraping farms, no automation that evades platform controls, no fake-account sampling;
• Consumer-interface observations are manual, disclosed as such, and stamped with account context, region, and time;
• API measurements are labeled as API measurements — never marketed as consumer-experience rankings (measurement standard).

Prompt-injection and pipeline safety

Fetched web content is treated as untrusted input: it can contain instructions aimed at analysis models. Our pipeline separates fetching, parsing, and analysis; analysis stages run without credentials, without network access, and without publish permissions. Nothing moves from analysis to a client-visible surface without human review — which also serves as the injection backstop.

Claims we will not make

• Guaranteed rankings, mentions, or recommendation rates on any platform;
• “Control what AI says about you”;
• Cross-platform composite “AI scores” without published definitions, samples, and limits;
• Effect claims without controls; causation claims from directional data;
• Adjudication of user opinions or reviews.

Restricted domains

This release does not serve engagements whose core purpose is influencing high-stakes verdict domains — medical, financial, or legal advice outcomes. Related facts incidental to a normal engagement (e.g. a security certification) are handled under the standard evidence rules.

Data-region separation between the China and global sites is covered in Data regions.