Start here
Document register
The 34 controlled documents behind this platform, and what may be released from each.
- Published
- 20
- On request
- 8
- Internal
- 6
The public documentation on this site is written for an external reader. It is not the internal document set republished, and the difference is deliberate: those documents assume context an evaluator does not have, and several of them record decisions that are still open. Each public page names the repository document it was written from, and this register says what may be released from the rest.
PublishedPermalink to this section
The substance of this document is on this site. Where the public page is a rewrite rather than the document itself, the page says so and names its source.
Capability design
PublishedBusiness capabilities, personas and end-to-end journeys.
docs/capability-design.mdOwner: Product ownerSolution design
PublishedArchitecture, module boundaries and technical controls.
docs/solution-design.mdOwner: Engineering leadArchitecture
PublishedRuntime shape, deployment topology and dependency posture.
docs/architecture.mdOwner: Engineering leadCompliance control matrix
PublishedControl ownership, evidence and acceptance traceability.
docs/compliance-control-matrix.mdOwner: MLROOperating model and RACI
PublishedRole separation, hand-offs and escalation.
docs/operating-model-raci.mdOwner: Compliance administratorPermissions and personas
PublishedThe effective access model and separation of duties.
docs/permissions-and-personas.mdOwner: System administratorProcess SOPs
PublishedRepeatable day-to-day operating procedures.
docs/process-sops.mdOwner: MLROTraining and user guide
PublishedRole-based adoption and competency evidence.
docs/training-and-user-guide.mdOwner: Training ownerCase workspace
PublishedHow investigation context is assembled and recorded.
docs/case-workspace.mdOwner: Product ownerRegulatory reporting workbook
PublishedReport mappings, source evidence and regulator gates.
docs/regulatory-reporting-workbook.mdOwner: MLROReport distribution
PublishedHow a produced report reaches its recipient, and what is recorded.
docs/report-distribution.mdOwner: MLRONigerian address and DNFBP notes
PublishedAddress coding, SCUML identifiers and DNFBP-specific handling.
docs/nigerian-address-dnfbp.mdOwner: Product ownerAPI and integration guide
PublishedConsumer contracts and integration guardrails.
docs/api-and-integration-guide.mdOwner: Integration leadOpenAPI contract
PublishedThe source of truth for the HTTP surface. Server types and the TypeScript client are generated from it.
api/openapi/openapi.yamlOwner: Integration leadProvider adapter specification
PublishedSafe external identity, screening and source adapters.
docs/provider-adapter-specification.mdOwner: Integration leadOperations
PublishedRunning the platform: jobs, observability, routine procedures.
docs/operations.mdOwner: Platform operatorSupport and service management
PublishedSupport tiers, response targets and customer communication.
docs/support-and-service-management.mdOwner: Service ownerUAT and acceptance plan
PublishedHow business, security and operational readiness is demonstrated.
docs/uat-and-acceptance-plan.mdOwner: Product ownerDocumentation index
PublishedThe internal navigation map for the controlled set.
docs/documentation-index.mdOwner: Product ownerArchitecture decision records
Published34 records of an architectural decision, its context and its consequences.
docs/adr/Owner: Engineering lead
On requestPermalink to this section
Released to a customer or an evaluating institution under a confidentiality agreement. Ask through the contact route below.
Data dictionary
On requestData meaning, classification and lifecycle.
docs/data-dictionary.mdOwner: Data ownerField-level classification of a live compliance schema is more use to an attacker than to an evaluator.
Entity relationship model
On requestThe relational model behind the domain.
docs/erd.mdOwner: Engineering leadSchema detail is released with the data dictionary, under the same agreement.
Security threat model
On requestThreats, mitigations and residual risk.
docs/security-threat-model.mdOwner: Security leadIt records residual risk — the things a control does not fully cover. That belongs in a review under agreement, not on an open page.
Business continuity and DR
On requestRecovery objectives, drills and dependencies.
docs/business-continuity-and-dr.mdOwner: Platform operatorRecovery objectives are commitments; they are agreed per contract.
Incident response runbook
On requestDetect, contain, recover and learn from incidents.
docs/incident-response-runbook.mdOwner: Security/operations leadPublishing detection and containment steps tells an attacker what to expect.
Infrastructure requirements
On requestSizing, topology and environment prerequisites.
docs/infrastructure-requirements.mdOwner: Platform operatorSized per deployment; released during implementation planning.
Deployment configuration reference
On requestEnvironment, secrets and preflight configuration.
docs/deployment-configuration-reference.mdOwner: Platform operatorIt enumerates secret material and preflight checks for a live environment.
Installation guide
On requestStanding the platform up, including the air-gapped path.
docs/INSTALL.mdOwner: Platform operatorReleased to a customer with the deployment bundle.
InternalPermalink to this section
Working material for the engineering and compliance teams. Not released, because it records unresolved questions, residual risk, or a named client's data.
Playwright E2E guide
InternalBrowser test inventory, fixtures and how to read a run.
docs/playwright-e2e.mdOwner: QA engineeringEngineering working material with no external reader.
BRD traceability
InternalRequirement-by-requirement mapping to implementation.
docs/brd-traceability.mdOwner: Product ownerIt maps a specific client's business requirements document, which is theirs and not ours to publish.
Open questions
InternalUnresolved decisions, with their owners and blocking conditions.
docs/open-questions.mdOwner: Product owner1,741 lines of questions that are open by definition. Published, it would read as a defect list rather than as the working register it is.
Phase 2 scope
InternalWhat is deliberately outside the current release boundary.
docs/phase2.mdOwner: Product ownerA roadmap published is a roadmap committed.
QA participant onboarding runbook
InternalStanding up test participants for an acceptance environment.
docs/qa-participant-onboarding-runbook.mdOwner: QA/platform engineeringCovers credential handling for named test participants.
Showcase dataset
InternalThe seeded demonstration dataset and its provenance.
docs/nexim-showcase-data.mdOwner: QA/platform engineeringPrepared for a named institution's showcase.
Requesting a document
Documents marked on request are released to a customer or an evaluating institution under a confidentiality agreement. Ask through the contact route, naming the document and the review it is for. Documents marked internal are not released.