Method

Where to start

CATK keeps one investigation and shows it in three views. These are not three apps: the same records lie under all of them. If you rename a node in the Graph, the article that cites it shows the new name.

The work moves along one chain. Each step has its place in the interface, and each step answers the one before it:

1. Source
2. Fact
3. Relation
4. Gap
5. Verification task
6. Confirmed material
7. Publication

• Graph — findingRecords and the relations between them. A fact appears here, and a gap in the evidence becomes visible here too.
• Operations — checkingA gap becomes a task with an owner. When you close the task, the product offers to write its result into the record. It writes it only after you confirm.
• Newsroom — publishingChecked records and their sources become a material. You cannot set the status to Published while the material has no source or no linked record.

Nothing is lost between the views because nothing is copied between them. There is one investigation, shown three ways.

Verification: what the four marks under a card mean

Under every card there are four short segments. Nobody sets them by hand. They count the steps of verification this record has passed. Hover the card and the tooltip lists the steps that are done.

• Source namedThe evidence field is not empty, or the record points at a source record. A link, a document number or an analyst note all count. Pointing at a record is better than typing a line: several facts can cite the same record, and a line of text cannot be cited.
• Document attachedA file is attached to the record. A note about a document is not the same as the document. You can argue with a note; a document you can read.
• Verification task closedA task of type Verification linked to this record has the status Complete. The Graph reads this from the Operations section: close the task there, and the mark lights here.
• CountersignedTwo people, two moments. The reviewer opens the investigation on their own machine, presses “Sign it for someone else” and sends you the file; you open it with “Open a signature sent to you”. No server is needed for this. The signature means that the owner of that key saw the record in exactly this form. It does not mean that the record is true, and it does not prove who that person is: the name beside a key is written by whoever holds the key. Your own signature is kept and shown, but it never counts as the second person — otherwise one person would close this step in two clicks. If you change the record afterwards, the signature stops counting, because it was given for a different version.

The steps have no weights, and they will not get any. Naming a source and getting a countersignature differ in weight, and any percentage we assigned them would be made up, the same problem as the slider this replaced. The product counts four steps and shows which of them are done.

This measures the process, not the truth. A record can have documents, a closed task and a signature, and still rest on a forgery. That is why it is called verification and not confidence.

The same thing can be shown by colour across the whole canvas: in the key, switch the scheme to Verification progress, and every card is painted by how far it has gone.

Analyst estimate: your opinion, kept apart

Sometimes a person has to say that they do not believe a record, and no checklist catches that. The estimate is that sentence written as a number. You set it by hand in the record editor, and that is deliberate.

It is kept apart from verification and never mixed into it. Two numbers that mean different things should not be averaged into one that means neither.

A record can carry no estimate at all, and then a dash stands in its place — on the card, in the inspector and on the timeline. The product used to write seventy per cent there on its own: an opinion nobody had stated. Move the slider and the estimate exists; leave it alone and there is none. A template arrives this way on purpose, its slots empty.

• VerificationCounted from the investigation. Anyone can check where each mark came from.
• EstimateSet by you. Nobody can check it, and the product does not pretend otherwise.

Colour: one question at a time

Colour is the strongest signal a graph has, so it answers exactly one question. The key in the strip above the canvas always names which one. Switch the scheme there, and the same records are repainted.

• RiskHow dangerous the record is for the investigation: high, watch, flagged and so on.
• TypeWhat kind of record it is: person, organization, location, wallet, source, channel, event.
• EvidenceWhether anything supports it at all — a source or an attachment.
• Verification progressHow many of the four steps are done.

The rule of one scheme at a time is what makes this honest. Amber can mean a location in one scheme and a review state in another, because the two schemes never appear on screen together and the key says which one is in force.

Red is reserved for risk and for destructive actions. If you see red, either the record is dangerous or the button destroys something.

The key lists only what is actually on the canvas. A value nobody uses is not shown, so the key never explains something you cannot see.

Relations: the line says how sure it is

A relation is a claim: this is connected to that. The shape of the line says how well the claim is supported. It is the same kind of code as the colour of a record.

• Evidence attachedA source or a document stands behind the relation.
• AssumedAn analyst stated it, and nothing confirms it yet. Most new relations start here.
• DisputedSources say different things. The disagreement itself is the fact here, and it stays visible until a source settles it.

The line follows what is attached, not the mark in the editor. A relation marked as verified is still drawn dashed while it has no source, no named source record and no document attached, the same way Gaps names it.

An arrow shows direction: who acts on whom. A relation can also run both ways, and then it has an arrow at each end. That is not the same as having no direction at all.

Double-click the label on a line to open its editor. There you set the direction, the evidence and the dates the relation was valid, and there you can delete it if it turned out to be wrong.

Map: points, areas and routes

A record is placed on the map by two separate fields: the name of the place, as you wrote it, and a pair of coordinates. Neither is derived from the other. A named place with no pair is a normal state: the record stays in the Without coordinates list and still says where it is.

A point claims exactly here, and most sources say less: a port, a town, a stretch of river. For that a record has a radius in kilometres, drawn as a circle around its point, and an area, a boundary you draw or type. A relation can have a route: the path it took, from its start to its end. A record with an area and no point stands on the map by its area and has no pin: a pin would claim a point nobody set.

• Draw it on the mapSelect one record and press Draw an area, or one relation and press Draw a route. Each click adds a point. Enter, a double click or Finish ends the drawing, Backspace takes the last point back, Escape leaves without a change. The finished shape is one undo step.
• Or type itThe record editor has Area coordinates and the relation editor Route coordinates: one point per line, latitude first, then longitude. A GeoJSON geometry can be pasted too.

A shape is refused, with the reason next to the field or above the map, when the border of an area crosses itself, when an area has fewer than three points or a route fewer than two, when there are more than 500 points, and when a coordinate is out of range. A route may cross itself: a ship can sail a loop.

A shape that came in a file and cannot be read is kept as it came. The map does not draw it and names it under Not drawn, with the reason: an unknown value does not disappear.

A person has no area, and a relation touching a person has no route: the product does not draw where a human is or the path they take. A shape a file brings for a person is kept, not drawn, and named under Not drawn; select the person and Remove the area takes it off.

Limits of this work: an area is one ring, without holes. A shape that crosses the 180th meridian is drawn the long way round the map. A route is drawn in straight lines on the map and does not follow the curve of the earth.

Gaps: what the investigation is missing

The Gaps panel is the evidence layer. It reads the investigation and names what is missing. It never edits anything itself, and that is the point: the product proposes, a person decides. A click on a row selects what the gap is about. If that record lies in a collapsed cluster, the cluster opens on the canvas, because a selection you cannot see is no selection. The investigation itself does not change: the cluster stays collapsed in the file, and the click writes no undo step.

• Disputed relation without evidenceA disagreement cannot be settled without a source, so it comes first in the list.
• Relation without evidenceThe connection is stated, but nothing supports it yet.
• Two records under one nameOne object written down twice splits its relations between two records.
• Record without evidenceNothing attached supports this record.
• Place named, point missingThe map knows the place exists but cannot show where it is.

There are three answers. Show in the graph selects the gap's record or relation on the canvas and brings the view to it, and a double click on the row does the same. Accept opens a verification task in Operations, already filled in from the gap. You save it, and after that the panel says the gap is in progress instead of offering a second task for the same thing. Dismiss records that you looked at the gap and left it.

Proposals are not stored. They are computed from the investigation every time, so a gap you actually fix disappears on its own. Only your answer is kept.

The proposals come from rules, that is simple checks that never get tired, from a sanctions list when you load one, and from a model when you ask it about a record. All of them stand in the same queue under the same rule: they propose, you decide.

Analysis: what the investigation rests on

Gaps looks at one record at a time: this relation has no source, this record has no document. Analysis looks at the shape instead. Four relations can each look like a small piece of unfinished work, while together they mean that a whole conclusion rests on nothing.

A chain is a stretch of the investigation where two or more relations without evidence follow one another. One such relation is a gap, and you know what to do with it: attach a source. Two in a row say something that neither of them says alone.

• It is cut at every forkWhere a record has three or more unsupported neighbours, the chain ends. At a fork you choose the path rather than read it, and calling one branch the continuation would be choosing for you.
• It is drawn, not describedThe steps are the same lines the canvas draws: a dashed line for an assumption, a short red one for a disputed relation. None of them can be solid, because a solid line inside a finding would claim evidence exactly where the finding says there is none.
• It disappears on its ownA finding is computed from the investigation every time. Attach a source to one step, and that chain stops existing. A dismissal cannot outlive the thing it answered.

A load-bearing relation holds two parts of the investigation together: remove it, and its part of the graph falls in two, with more than one record on each side. When it has no evidence, the conclusion that joins the two parts rests on one unsupported claim. The card names the relation by its two ends and counts the records on each side. It does not call the relation false and does not rank it: the count says only how large a side is.

Two records with no relation between them that share two or more neighbours are a question for you. The card names both records and their shared neighbours, each with its two relations in their usual form. It never says that the two are connected: the rule counts the shape of their surroundings, and a relation proposed by it would be a made-up figure. One shared neighbour is not a finding, because that is how any star looks. Two is the smallest number at which matching surroundings stop being a property of one record.

A finding names the shape, not the meaning. Whether the connection is real, and how much it matters, is yours to decide. Any number we put on that would be made up, and made-up numbers are forbidden here.

There are three answers, the same as for a gap. Show in the graph selects on the canvas what the finding is about: the stretch of a chain, the load-bearing relation, or the two records with their neighbours. Create a verification task opens Operations, filled in from the finding. Dismiss records that you looked at it and left it.

The model: what it does, and what it will never do

The model stands in the Gaps list as a source of proposals beside the rules and the sanctions lists. It is switched on per workspace and asked about one record at a time: Ask the model, in the Evidence tab, sends that record and its relations to Anthropic with your own key. Its answers are not taken as true. Each proposal quotes the text it was read from, and the product keeps a proposal only if every quotation stands word for word in the field it names.

• See what a rule cannotA rule checks whether a field is empty. A model can notice that a person named in the description is missing from the graph, or that two fields disagree about a date. Whether a name is in the graph the product checks itself, across the whole investigation: the model never saw the graph.
• Word a relationThe label of a relation says less than the text: related, while the description says director. The model proposes what the relation is and quotes the sentence it read that from.
• Read an attachmentA text document of the record, such as a .txt, .csv, .md or .json file, goes to the model only by its own button, Ask with the documents. The model proposes a date, number or name that the document states and the record does not carry, and the product checks the quotation against the text that was sent. A PDF or a scan does not go: its text cannot be read on this machine, so a quotation from it could not be checked. The window names every document before the press and says why one stays.

Three boundaries hold, and they are what make this usable in an investigation.

• It never edits a recordEvery proposal goes into the same queue as a rule's proposal: accept or dismiss. Nothing changes behind your back.
• It always says where it read thatA proposal without a quotation would be an invented indicator, and those are forbidden here.
• It is switched on per workspaceIts request carries the text of one record and its relations to Anthropic. That is more than a square of the map and more than a search string, so the product cannot stay silent about it. Anthropic keeps the request and the answer for 30 days by default, longer when a request is checked for a breach of its usage policy or when the law requires it.

The key is yours, and so is the bill: the answers are paid from your Anthropic account. The key is kept in this browser on this machine. Workspace files and the rescue file do not carry it, but anyone who can read this browser's storage can read it.

An answer is kept in the workspace together with what was sent, and it travels with export and synchronization: a second person sees what the model said and does not pay for the same question. When the record changes, its proposals say they were asked about an earlier form of it. Asking again replaces the answer. A proposal is dropped, and counted, when one of its quotations is not found in the field it names.

Sanctions lists: what a match means and what it does not

Three lists can be loaded, each in its own card, from files you downloaded yourself. OFAC SDN takes SDN.CSV and, if you want, ALT.CSV with other names of the same entries and SDN_COMMENTS.CSV with the rest of long remarks. The EU consolidated list takes its CSV file, version 1.1. The UK Sanctions List takes its CSV file. The product downloads nothing and sends nothing; the files are read on this machine. The lists are kept here for every workspace and do not go into the workspace file. A file of another list chosen in a card is not read: the card names the list it belongs to.

Matches come into Gaps as proposals, one for each record and list entry, and each says which list it came from. The answers are the ones any gap has: show the record in the graph, accept a verification task, or dismiss. By itself a match changes nothing in the record. A dismissed match comes back only when the record matches the same entry more strongly, for instance when an IMO number is added to a ship dismissed by its name.

• Wallet address matchesAn address in the record's name or description stands in the remarks of an OFAC entry. Addresses starting with 0x are compared without case, the rest exactly. The EU and UK lists name wallets only in free text, and that text is not read for them.
• IMO number matchesThe record names an IMO number, written as IMO 9123456, IMO No. 9123456 or ИМО 9123456, and the same seven digits stand at an entry: in the remarks of OFAC, in an imo document of the EU, in the IMO number column of the UK list. Numbers are compared on a record of any type.
• Full name matchesThe name has the same words as a listed name, in any order: OFAC lists people as SURNAME, Name, and the EU and UK lists also give names in other scripts. Every name of an entry is compared. Legal forms such as LLC or OOO are left out for companies.
• Every word of the name is in the listAll the words of the record's name, at least two, stand in one listed name. This is how Ivan Petrov meets PETROV, Ivan Sergeevich, and also how a namesake does.

A match is not proof. Namesakes and companies with shared words give false matches, and three lists give more of them than one, so compare the date of birth, citizenship, address and registration numbers in the list entry. There is no percentage of similarity: a number without a formula is not shown here.

No match is not proof either. Cyrillic is written in Latin by one table, the Russian BGN/PCGN system, so a Serbian name written the Russian way (Костич rather than Kostić) does not meet KOSTIC. OFAC cuts remarks at 1000 characters and puts the rest into SDN_COMMENTS.CSV. Choose that file together with SDN.CSV, and the rest is read. Without it a wallet or an IMO number in the rest is not found, and the notice after loading says how many remarks were cut. Only these three lists are checked; OpenSanctions is not used, because its data is under a non-commercial licence.

The date of the OFAC list is asked when you load it. Its files carry no date, and the moment you downloaded them is not the date of the list. Left empty, every match says the date was not given. The EU and UK files carry their own date, and the card says it is the date of the file. Replace loads newer files over the old ones, and Remove takes that one list off this machine; the other lists stay. Dismissed matches stay dismissed.

Wikidata dossier: what it takes and what it sends

For a person, an organization or a vessel, Wikidata can show what is written about it there: the country, the owners and managers, dates and registration numbers. It opens from the record's Evidence tab with Find in Wikidata. Everything the dossier shows is somebody else's statement, not your verification.

It is off for every workspace until you turn it on, because what it asks tells the Wikimedia Foundation who is being investigated. Out go the record's name, its IMO number or LEI code if the record names one, the number of the item you open and of the items it points to, and the owners you tick, all with the address of this computer. The address of the site the product is open on does not go: the requests leave from a sandboxed frame that has no address of its own. Turning it on sends nothing; each request is its own press and names the product with a link to its source code, as Wikimedia asks of clients in a browser. Open in Wikidata opens the item in an ordinary browser tab, where Wikimedia sees your browser as usual, including your account if you are signed in.

• SearchBy the name, and by the IMO number or LEI code if the record names one. An item found by its number comes first and is marked.
• Choose the itemYou choose, even when there is one candidate: Wikidata has namesakes, as the sanctions list does.
• Save as documentThe answer becomes a document of the record: a JSON file with the time of the request and its SHA-256, like any file you attach. It travels with the workspace file.
• Add relationsTicked statements become relations to records marked as taken from Wikidata and not verified here. An owner Wikidata records as a human comes in as a person, any other owner as an organization; when that question does not come back, owners are left out.

• Date of birthOnly to tell namesakes apart. It is shown as precisely as Wikidata records it: a year stays a year.
• CitizenshipThe country, as Wikidata records it. A person can have more than one.
• Position heldStays in the dossier and in the saved document, but is not offered as a relation: the product has no type of record for a position.
• EmployerCan be added to the graph as a relation to an organization, marked as borrowed.
• Owner ofShown in the dossier and kept in the saved document. It is not offered as a relation.

Saving the document or adding relations also links the record to the item. The record's Wikidata section then names the item, and the dossier opens straight on it, without a search; Back to the search leads to the search. Only your press in the dossier makes the link, never a matching name. An owner one of your records is linked to gets the relation, not a second record, while a record you have not linked can still end up in the graph twice: as yours and as a borrowed one. Unlink removes the link and keeps the document and the relations already added. A copy of a record does not carry the link, and a countersignature covers it. A statement where the item names itself is shown and not offered as a relation: a record is not related to itself.

About a person the dossier never takes statements on the spouse, children, father and mother, brothers and sisters, other relatives, partners or the place of residence. This is the boundary of SCOPE.md: a person stands in an investigation in the capacity a public record gives them, and family and home are not that capacity. The item's one-line description is kept as Wikidata's editors wrote it, and now and then it names a relative. Relatives of public officials, a PEP check, would be a separate decision.

A matching name is not proof, and nothing found is not proof either: Wikidata is uneven, small companies often have no item, and large ones can have an outdated one. Each statement shows how many sources Wikidata itself gives for it, and that number can be zero; an import from a Wikipedia edition is not counted as a source.

The dossier shows Wikidata at the moment of the request: an unsaved dossier can look different tomorrow, and the saved document keeps that moment. Dates keep the precision Wikidata records, so a day and a month that are not in the source are not filled in. If Wikidata refuses for too many requests, the window says so when the refusal can be read, with the wait in seconds when it names one, and otherwise says that Wikidata did not answer; the request is not repeated by itself.

Wikidata's structured data is under CC0, which asks for nothing. The product names the source anyway, because a borrowed record has to say where it came from. The text of Wikipedia articles is not taken.

Domain snapshot: what it asks and whom

For a record of any type, the snapshot asks public services about a domain and keeps their answers as a document: when the domain was registered and with which registrar, its name servers and mail, the names in its certificates and whether the web archive has seen the site. It opens from the record's Evidence tab with Take a domain snapshot. The window offers the site addresses written in the record, and the domain names written in it in a country zone or a common general zone; you pick one or type your own. What the snapshot shows are the services' answers at that moment, and nothing in them was checked in this investigation.

It is off for every workspace until you turn it on, because a snapshot tells outside services which domain is being looked into. The domain name goes to the zone's registry, to the registrar the registry names, to Cloudflare, to crt.sh and to the Internet Archive, all with the address of this computer. The IANA list of registries is fetched without the name. The address of the site the product is open on does not go: the requests leave from a sandboxed frame that has no address of its own, and the frame asks only names on the public internet, over https. The domain's own servers are never asked: their owner sees every visitor in the logs, so the window writes the name as plain text with no link, and DNS goes through the resolver. Nor is a service asked that lives under a name the domain shares: a snapshot of www.verisign.com would otherwise ask Verisign's own .com registry. A redirect is named and not followed. IP addresses and the names of home and office networks are refused, though a public name that leads into your own network cannot be told by its name. Turning it on sends nothing. A snapshot is one press, and the product repeats nothing by itself.

• Registration dataThe IANA list says which registry serves the zone, and the registry gives the registrar with its IANA number, the dates of registration, expiry and last change, the status codes, the name servers and whether the zone is signed with DNSSEC. A registry that keeps the holder itself gives the holder's organisation and country too. A registry knows only registered names: for a name it does not know, the window says it may be a subdomain. Many national zones publish no RDAP, among them .ru, .рф, .de, .eu and .io. Their registries answer only over WHOIS, which a browser cannot reach, and the window names the zone.
• Registrar dataThe registrar the registry names, at the link in the registry's answer, so it cannot be asked without the registry. When the registry gave no answer about this name, named no registrar, or named one at an address the snapshot does not ask, the window says which. From the holder only the organisation and the country are taken, and registries and registrars usually hide even those.
• DNSCloudflare answers for the domain's A, AAAA, MX, NS, TXT and SOA records and for the CNAME of www. The domain's name servers see Cloudflare's resolver and never your address. A DNS answer holds for the moment and the place of the question: another resolver or another hour can give other addresses.
• Certificatescrt.sh, a service of Sectigo, reads the certificate transparency logs: the names in certificates, the issuer and the dates. The logs hold only publicly trusted certificates, older ones may be missing, and a name in a certificate does not prove that the subdomain ever worked. The window counts the certificates found apart from those kept in the document: the list stops at a thousand, and e-mail certificates are not kept. crt.sh is sometimes unavailable for hours, and then the part says there was no answer.
• ArchiveThe Internet Archive names its nearest and its earliest capture of the site, for the domain and for www. Its answer changes from one request to the next, so only a named capture counts as a fact: an empty answer is written down as the archive naming no capture, and it does not mean the site was never archived.

From the holder the snapshot takes only the organisation and the country. The name, e-mail, phone, street and contact form are never taken, even when the registrar did not hide them, and neither are the domain's other contacts: this is the boundary of SCOPE.md. The administrator's mailbox in SOA is not taken, a TXT string with an e-mail address in it is dropped whole, and so are e-mail addresses among the names in certificates and in their issuer's name. Who took an action on the domain is not taken from its events, and a certificate's subject counts only when it repeats one of its names: in an e-mail certificate it holds a person's name. The document lists what was left out and why. The organisation field sometimes holds a private person's name; the product cannot tell, and whether to save the document is yours to decide.

Each part waits 20 seconds for an answer. A part that refused or stayed silent does not stop the others, and its state is said in words: nothing found, refused with its code, asked for a pause, no answer, answered with a redirect it does not follow, answered about another name. Registries allow lawful use and forbid mass automated queries, so a snapshot is taken on a press, one at a time: there are no batches and no schedule, and the product does not ask a refused part again by itself.

Save as document puts the answers into a JSON file of the record with the time of the snapshot and its SHA-256, like any file you attach, and the file goes into the workspace file with the other documents. The hash shows that the document did not change after saving. It cannot show that a service said what is written: the answers are not signed. The terms each registry and registrar sends with its answer are kept in the document as they came.

Apart from the new document and the time of the change, the record does not change. The date the domain was registered belongs to the domain and does not become the date of the record; the time of the snapshot is when the answers came, and it is not the date of any event either. The snapshot adds no records and no relations.

Records taken from elsewhere

A record brought in from another database is somebody else's statement, not your verification. CATK marks every one of them and writes the source and the licence into the evidence field, where an analyst actually reads.

That sentence alone is not evidence: it names where the record came from and says it was not verified here. A record or relation that carries nothing else counts as having no evidence, so its line on the canvas is dashed and Gaps list it. The step Source named is still passed, because the source is named. Your own words beside the sentence count as evidence, as before.

The licence is asked for because it decides what you may do with the work built on those records. It is written on the dataset's own page, and these are the ones you will meet:

• unknownThe licence is not stated. This is an honest answer and the product accepts it: a made-up licence would be a made-up fact, and those are forbidden here.
• CC0No conditions at all. Use it, change it, sell it, and you are not even required to name the author.
• CC BY 4.0Anything, including work you are paid for, as long as the author is named where you use it.
• CC BY-SA 4.0Anything, if the author is named and whatever you build on it carries the same licence — you cannot close what was open.
• CC BY-NC 4.0The author is named, and money is not allowed. A dataset under this one cannot go into a product you sell.
• ODbLMade for databases: name the source, and a database you altered stays open on the same terms.

This is a short guide; the licence itself is elsewhere. The full conditions live with the dataset, and when the answer matters, for a paid product or a republished database, read them there. CATK only records what you tell it.

What leaves this machine

By default, nothing. The investigation is kept in this browser, the world outline ships inside the app, and the product makes no request on your behalf until you turn on a source or synchronization.

Every source is switched on per workspace, and each one states its cost on the screen where you switch it on:

• Map tiles (OpenStreetMap)Every pan tells their servers which square of the earth you are looking at. From a series of such requests the area of the investigation can be reconstructed.
• Satellite tiles (Sentinel-2, from EOX)The same square of the earth, at ten metres to the point — and one limit beyond the request itself: the licence is non-commercial. The day this product is sold, this basemap has to come off or be licensed separately.
• Place lookup (Nominatim)The name you type is sent to OpenStreetMap, or to another Nominatim server you name for this workspace with Change the lookup service in the record editor. Coordinates are filled in only from the option you pick: the product never turns a name into a point by itself.
• Public cameras (YouTube, Fintraffic, USGS)All three lists of places ship inside the app and are asked of nobody. Opening a stream opens a YouTube player: Google learns your address and which place you are watching — more than a square of the map. That list was collected from worldwatcher.live, which states no licence; that is said here rather than guessed. Opening a road camera loads its latest image from Fintraffic: Fintraffic learns your address and which camera you opened. Road cameras are Fintraffic's open data under CC BY 4.0, and the map names them with the line their terms ask for. Opening a river camera loads its latest image from the USGS bucket on Amazon S3: the USGS and Amazon learn your address and which camera you opened. USGS images are in the public domain, and the map credits the U.S. Geological Survey as it asks.
• Wikidata dossier (Wikimedia Foundation)A search sends the record's name, and its IMO number or LEI code if the record names one; opening an item sends its number and the numbers of the items it points to. All of it goes with your address: Wikimedia learns who is being investigated. Everything is asked on a press, never on each letter.
• Domain snapshot (registries, Cloudflare, crt.sh, Internet Archive)A snapshot sends the domain name to the zone's registry, to the registrar the registry names, to Cloudflare for DNS, to crt.sh for certificates and to the Internet Archive; the IANA list of registries is fetched without the name. All of it goes with your address, and each service learns which domain is being looked into. The domain's own servers are never asked.
• Model (Anthropic)Each press of Ask the model sends one record and its relations: the record's name, type, description, evidence, place and date, and for each relation the other end, the label and the evidence. It goes with your key, your address and the address of this site. Anthropic keeps the request and the answer for 30 days by default. The client of the model loads only at the first question.
• Sync server (your own)Turned on in the Synchronization window, for one workspace. The whole investigation of that workspace goes to the server, encrypted on this device, and the server cannot read it. What it does see is who writes, when and how much, and the address of your computer.

Requests to all of these sources except Wikidata, the domain snapshot and road camera images also name the site the product is open on: its scheme, name and port, without the page itself. On this machine it is a local address such as 127.0.0.1, which says nothing; on a hosted copy it is the name of that installation, and the source learns whose installation is asking. The browser puts it into the Origin header of every request whose answer the page reads, and the page cannot take it out. So Wikidata and domain snapshot requests leave from sandboxed frames that have no address of their own: they carry no Referer, and their Origin is null. OpenStreetMap's terms require the Referer for map tiles and for place searches, so there it stays. A road camera image is loaded as an ordinary picture: such a request carries no Origin, and the product removes its Referer.

Unless the workspace turns sync on, records and attachments stay on this machine: the graph in the browser storage, files in its database. Export writes a file that you keep and does not send it anywhere.

“Export → Workspace” puts the whole investigation into one .catk file: the graph, the articles, the verification tasks and the documents themselves. It is an ordinary archive, so the person you send it to can open it with any unpacking program and read the documents even without CATK.

If the documents weigh more than about 200 MB, the product asks first: a file that large can be too much for the browser to assemble. You can send it without them, and then the documents are named in the file but not in it.

Before the file is written, the product offers to encrypt it with a passphrase. An encrypted file cannot be read by anyone who does not know that phrase, wherever it ends up: a memory stick, an email, a cloud folder.

There is no way back. Forget the phrase and the file cannot be opened by anyone, including you: no key is stored in it or anywhere else. Only the file is encrypted, never the investigation in this browser, so a forgotten phrase costs one file and not your work.

Synchronization: a shared workspace on a server that cannot read it

Synchronization lets several people work in one workspace. It stays off until you turn it on for a workspace in the Synchronization window, which opens from the status line in the side panel (on a phone, under More). The window says what the server will see before you press Turn on synchronization.

• Your cardEach person has a signing key, and on each machine a device key that the signing key vouches for. Download the card and give it to whoever adds you, then read your fingerprint back to them by voice or in person.
• Add by cardThe card shows a name, which nothing vouches for, and a fingerprint of eight groups. Check the fingerprint with that person before adding them: a card with another fingerprint belongs to someone else.
• Open hereThe person you added finds the workspace under Invitations and opens it on their machine as a new workspace. Its name travels in the journal, encrypted like the rest, and arrives with the first synchronization: the server knows no names. Any member can rename it with ✎ on its row in the side panel, and the new name reaches the others the same way.
• Edits travel by themselvesTwo seconds after an edit, when you come back to the tab and every half minute. Each entry is encrypted, signed by its author's device and chained to the one before, and an entry that does not check out is not applied at all.
• ConflictsWhen the same record was changed here and by someone else, the journal's version stands and yours waits in the window. Keep the journal's, or Take mine: then your version goes into the journal as a new edit.

The server sees who logs in, from where and when, who is in which workspace with which role, and how many entries and bytes each person writes. It cannot see names, relations, evidence, texts or documents. It can hold back new entries or show two people two different journals. Each device puts down a signed mark of how far it has read, and a mark that runs past your journal or disagrees with it stops synchronization, and the window says why. A server that hides the marks is caught only outside it: read your head code to another member by voice or in a messenger, and they compare it under Journal check.

The signing key is your name. Whoever holds it can log in as you and revoke your devices, though they read no workspace until a member seals its key to their device. A copy under a passphrase lets you keep your name if this machine is lost, and whoever opens the copy becomes you.

Documents travel too. Each one is encrypted with its own key, and the key rides inside the journal entry; the server keeps the ciphertext under a random name and sees its size. On the other machines a document arrives with the next synchronization and is kept only if it opens with its key and matches its hash. The window names how many did not arrive, and the next synchronization tries them again. A document no record names any more leaves the server once the journal takes the entry that let it go. What was downloaded before stays on the machines that have it.

Removing a member gives the workspace a new key, so they do not read what is written after they leave. What they read before stays with them.

Data quality: what a source can get wrong

Every source the product can ask gives an answer, and an answer can be late, partial, modelled or wrong. The product puts the source next to what it brought, so you can weigh it. Which source to trust is your decision.

• Sanctions lists (OFAC, EU, UK)Files you download yourself. OFAC's you date yourself; the EU and UK files carry their own date. A match on a name can be a namesake, and three lists give more of them. OFAC moves notes longer than 1,000 characters into SDN_COMMENTS.CSV, which is read only when you choose it with SDN.CSV.
• WikidataWritten by volunteers. A statement with no reference is someone's word, and the dossier counts the references it can see next to every statement.
• OpenStreetMap and place searchMaps made by a community. A place can sit in the wrong spot or under another name, and a point is set only when you choose it.
• Satellite imageryA cloud-free mosaic of one year. It shows the ground as it looked over that year.
• Public camerasStreams run by other people, road camera images from Fintraffic and river camera images from the USGS. A camera can be offline, moved, or pointed away from what its list says. A road camera image is the latest one published, renewed about every 10 minutes, and the product does not know when it was taken. A river camera takes an image every 5 to 60 minutes. One that stopped keeps showing its last image, sometimes months old, and the image does not say so. The list leaves out cameras silent for more than a week on the day it was collected, but a camera can stop after that.
• Records from another systemRecords brought in through FollowTheMoney are another team's claims. They arrive marked as borrowed and unverified here.
• Domain snapshotRegistries and name servers answer at the moment you ask. The answer can change the next day, and the document records when it was taken.
• Model (Anthropic)A model can misread, invent a name, or miss what matters. A quotation found in the text shows where it read that, not that it read it right. Asked again, it can answer differently.

The same rule holds for the product's own figures. A number is either counted from the data and explained, or it is not shown. The four verification marks count what was done to check a record; they do not say whether the record is true.