Trust
Trust is the feature, not the disclaimer.
This restraint is the architecture. BTree prepares the work, shows its sources and waits for a person. It never moves money.
Source-grounded
Every record carries a reference to where it came from, and every answer returns the rows it was computed from.
Deterministic
Totals, reconciliations and checks are calculated by tested code. The calculating core cannot call a model at all — that is enforced in the code’s structure, not promised.
Draft-first, never autonomous
A risky action becomes an approval that records the intent and the checks that ran. It executes nothing outside BTree.
Append-only audit events
Events are only ever added; a correction is a new event. Today the trail lasts for the session it was written in.
Contained execution
Agents that act run in a sandboxed runtime, with credentials held away from the model and per-connector network rules.
Sensitive data stays local
Sensitive family data processed on controlled hardware; only non-sensitive work goes to cloud models.
The risk ladder
Every action has a rung.
Read-only
Answers and explanations. Nothing changes anywhere.
Recommendation
BTree suggests; a person decides whether to act on it.
Approval-gated
BTree drafts the action and runs its checks — amount, duplicate invoice, missing W-9, entity match. A person signs off.
Forbidden, or professional review
Moving money, filing returns, and questions of tax, legal structure or securities. BTree does not do these.
What we do not claim
No badge before the control.
BTree displays a security or trust marker only once the control behind it is built and running. That is why you will not find certification logos or security badges on this site yet. When a control ships, it appears here with what it does and what it does not do.