PRAE / Pilot reference
Claims Review pilot
A defined review of the security, privacy and AI claims for one product.
This is a pilot reference, not part of the product catalog. Claims Review is a limited learning pilot under a separate written agreement, for up to three initial reviews. To build your own claim register, see the Books & Playbooks.
Proposed pilot fee: $1,500. The fee, delivery schedule, evidence handling and engagement terms are confirmed in writing before work starts.
Connect what you say to what you can show
Security and privacy claims spread across product pages, policies, documentation, app listings and sales material. A Claims Review brings the agreed public claims into one register and examines whether they are consistent, supported by the evidence provided and stated with the right limits.
We are inviting inquiries for three initial reviews.
Scope at a glance
| Element | Included |
|---|---|
| Subject | One named product and its primary domain, with ownership verified |
| Size | Up to 30 public pages and 75 distinct claims, whichever limit comes first |
| Pages | The agreed product pages, policies, trust or security page, documentation and relevant app-store listings |
| Public observations | Response headers, TLS configuration, public DNS and email-authentication records, the disclosure channel, and scripts or trackers the agreed pages load |
| Internal evidence | Optional evidence you supply for up to ten claims that cannot be checked from public information |
| Wording | Suggested revisions for flagged claims, with the reason for each |
| Recheck | One recheck of the same pages within 60 days of delivery |
Every page and claim counts toward the cap, including policies and store listings. More domains, products, pages, claims or rechecks need an agreed extension. The work uses ordinary public access: no logins, authentication bypasses, exploit attempts or active security testing.
What the review produces
A claim register
Each reviewed claim is linked to its exact source page and capture date, with the evidence considered, the conclusion, any uncertainty and the suggested action.
Prioritized findings
The report keeps these conclusions apart:
- Observation: something visible that may be worth investigating.
- Inconsistency: statements that do not agree with each other. It does not establish which one is right.
- Unsupported claim: the evidence available to the review does not substantiate the claim as written.
- Contradicted claim: the evidence examined conflicts with the claim, within the stated scope.
An unsupported claim is not automatically a false one. A public script, a missing header or a dated policy is an observation whose significance depends on context, and each finding includes the facts needed to judge that context.
Suggested wording and an evidence request list
For each claim needing attention we propose a correction, a qualification or a request for evidence. Statements that depend on internal settings or operations are marked as not verifiable from outside unless suitable evidence is supplied.
One recheck
We review the agreed changes on the same pages and record which findings were resolved, remain open or need more evidence. A changed page does not mean the system behind it changed; the recheck says exactly what it established.
What the review does not determine
It does not establish whether the whole application is secure, certify legal compliance or issue a public PRAE Assessment Record. It is not a penetration test or a legal opinion.
The legal accuracy of statements of law goes to your counsel. Mobile internals, source code, authenticated workflows and runtime testing need different scopes. We never treat the absence of public evidence as proof that an internal control does not exist.
What you provide
- The product and primary domain, and confirmation that you are authorized to request the review.
- The pages you want included, and any launch or procurement deadline.
- A product owner who can answer context questions.
- Optional sanitized evidence for the agreed internal claims, once handling terms are confirmed.
Do not send passwords, API keys, customer records, production databases or unredacted sensitive screenshots with an inquiry.
Delivery and handling
The delivery date is agreed after intake. The engagement sets who can access any private evidence, how it is transferred, and how long it is kept before deletion. Public pages and private evidence are handled as different inputs.
The report is private to the engagement. PRAE does not publish a customer’s findings, identity or logo without a separate agreement. A review supports your own decisions and corrections; it does not authorize a claim of certification or of independent verification of the whole product.
PRAE, a NULL Ventures company. Pilot brief v0.2, 29 October 2026.