Trust is not a statement —it is a set of verifiable controls
A commercial compliance product must answer four questions: where do outputs come from, how is enterprise data isolated, how are reports reviewed, and which conclusions cannot replace professional advice? This page marks each item as a control mapping, a target or a sample.
Framework control mapping and target status
These entries are internal control mappings or targets, not certifications, attestations or legal conclusions; independent certification status is NOT VERIFIED.
From source to audit — controls embedded in product workflow
Traceable sources
AI answers draw first on the platform’s policy, case and regulatory-update corpus, and cite sources when they exist.
Enterprise data isolation
Profiles, reports, saved items and projects are isolated per organization (row-level security), with admin, compliance editor, ESG lead and read-only roles.
Human-review boundary
Complex legal, tax and certification matters are flagged for human review and can be filed as expert review requests (confirmed case by case); AI output is never presented as legal advice.
Responsible compliance disclaimer
The platform supports decisions and materials; it does not replace licensed counsel or auditors.
Citation capability and limits
Models & providers
The code supports configurable reasoning and embedding providers; the providers currently used in production are listed in Annex III of the Data Processing Agreement. Each provider’s region and supplier data terms require deployment and contract confirmation (NOT VERIFIED).
Knowledge sources
Some workflows can retrieve from the knowledge base. Coverage, source licensing and production sync cadence require operational evidence (NOT VERIFIED).
Citations & limits
Multi-Tool Agent Advisor outputs can include citations when tool results provide provenance; Enhanced RAG Q&A cites retrieved sources, and source-free results may be uncited. High-risk outputs require human review and must not be treated as professional conclusions.
Data isolation
Authenticated chats may be persisted as part of the product. Retention, provider training use and private deployment depend on actual configuration and signed contracts and are not independently verified (NOT VERIFIED).
Availability depends on generated and approved evidence
AI output boundary statement
States that AI answers support decisions only and complex legal, tax, certification and filing issues require human review.
Data isolation and access-control note
Explains workspace isolation, member roles, server-side keys and audit-log boundaries.
Policy source and update mechanism
Records sources, update cadence and citation rules for the Policy & Standards Library, the Case Library and regulatory updates.
Expert review scope and delivery boundary
Defines the scope, inputs, deliverables and confidentiality of a human review; availability and timing are confirmed case by case.
Checks we recommend before a report goes outSample
Report quality checks (sample): these items describe what a report review looks at; the states shown are samples, not the result of a check run on any specific report.
Key conclusions are tied to policy, case or regulatory-update sources so customers and reviewers can check them.
Every remediation item has an owner role, priority, deadline and evidence requirement.
Legal, tax, certification and filing conclusions are not treated as final professional advice.
Compute carbon and fairness metrics still need finance, security and ESG owner confirmation.
An example log of actions, decisions and outputs
Compliance lead · Assessment report r001 · Today 10:30
ESG lead · Evidence register · ESG · Yesterday 16:20
Legal lead · Due diligence response pack · Monday
HaiWen HQ supports decisions — it does not replace professional advice
- Before any external disclosure, customer commitment or regulatory filing, key conclusions should be reviewed by licensed counsel / auditors / certification bodies.
- The platform does not accept advisory requests involving sanctioned entities, weapons proliferation, child exploitation or other unacceptable uses.
- The platform's publicly stated KB sync time governs; fast-moving areas always require human review.