Licensing, data handling and isolation

Non-exclusive, non-transferable

Clients receive a revocable licence to use the software as a service for the term of the engagement, covering the running system and its API output. It conveys no copy of the implementation, no right to sublicense or host it for a third party, and no right to reconstruct internal behaviour.

API output, not internals

An integrator sees request and response bodies. The rules, thresholds, orderings and prompts that produce those responses are not part of the interface and are treated as trade secrets.

What “black box” does and does not mean

It is accurate about distribution: the implementation is not handed over and an API consumer cannot read it. It is not a claim that the output cannot be studied. Anyone entitled to call an endpoint can observe what it returns, and we do not pretend otherwise.

Registered marks

ReliAble Independent Living Services Inc.® and ReliAble Living® are registered trademarks, used on this platform under licence from their proprietor. No client engagement conveys any right to use them.

Permitted use

Factual reference only — naming the service actually being received. The marks may not appear in a client’s own branding, product naming, domain names or advertising without separate written permission.

Separate from the trade-secret position

A trademark protects what the service is called; the trade-secret position above protects how it works. G Wiz Software Solutions Inc. asserts copyright in the platform itself. The three are additive, not alternatives.

You own your data

We hold it as a processor, to operate the service, and assert no ownership of client records, documents or submissions. On termination it is exported in a machine-readable form on request and deleted on the agreed retention schedule.

Encryption

AES-256 at rest across every store, Google-managed. TLS enforced in transit, with HTTP redirected to HTTPS at the edge. Both apply regardless of region.

Canadian residency, stated precisely

The assessment and claim intake paths — the ones that carry claimant-identifying and clinical material, and the ones PIPEDA and SABS workflows actually touch — are stored in northamerica-northeast2 (Toronto).

The platform as a whole is not. Two of eleven stores are Canadian; the operational databases, Firestore and the media buckets are in United States regions. A claim of blanket Canadian residency would be incorrect, and this page will not make one. The full table is in GOVERNANCE.md and is re-checked against the live infrastructure rather than carried forward.

Canadian residency for a store currently in the United States is available — Montréal and Toronto regions exist for Cloud Run, Cloud SQL, Firestore and Cloud Storage — but moving an existing store is a migration with downtime, not a flag. Where an obligation requires it, raise it before signing and it is scoped and priced as part of the engagement.

Tenant isolation in the query, not the interface

Tenant scope is applied server-side on every request, not by hiding a control. Access is re-checked per call rather than trusted from a token, so revoking an account takes effect immediately rather than at token expiry.

Each service runs as its own service account with secrets granted per secret where practical, so a compromise is bounded by that service’s grants rather than a shared project identity.

Database addressing

STRUCTiO’s database has no public IP and is reachable only over a private address from inside the VPC. Sessions are signed with a key held in Secret Manager rather than a per-instance value, so a session is valid across instances and invalid after rotation.

Encryption at rest is Google-managed AES-256 across every store, and TLS is enforced in transit with HTTP redirected at the edge. Those apply regardless of region.

Published: the API’s behaviour

Request and response bodies, status codes, error shapes, rate limits and the sequence in which calls must be made. Anything an integrator needs to build against, and anything they can observe by calling an endpoint they are entitled to call.

This is documented and stable. Breaking changes are notified before they reach production.

Internal: how the answer is produced

The rules, thresholds, orderings, prompts and schemas that turn an input into that response. Those run only in infrastructure operated by G Wiz Software Solutions Inc., are not deployed to client environments, and are treated as trade secrets.

Reverse engineering, decompilation, traffic interception to reconstruct internal logic, schema extraction, and bulk retrieval intended to reproduce a dataset or a model are each a breach of licence.

Where the phrase “black box” is accurate, and where it is not

It is accurate about distribution: the implementation is not handed over, and an API consumer cannot read it.

It is not a claim that the output cannot be studied. Anyone entitled to call an endpoint can observe what it returns and draw conclusions from it. We do not claim otherwise, and a vendor who does is describing something no hosted API can deliver.

Tenant scope is enforced in the query

Hiding a control is a convenience for the person using it; the boundary that matters is the one the server applies to every request. Access is re-checked on each call rather than trusted from a token, so revoking an account takes effect immediately rather than at token expiry.

Per-service identities

Each service runs as its own service account — STRUCTiO as sa-structio-app, and likewise for the platform backend, Dorothy @Home and the public site — so a compromise is bounded by that service's grants rather than a shared project identity. Secrets are granted per secret where practical.

Staff access, described accurately

Google and Microsoft work-account sign-in, with every OAuth round trip bound to the browser that began it and a mismatched callback refused with HTTP 403 before the code is redeemed. Administrative access is an explicit allow-list of individual addresses, re-checked on every request — not a domain rule; the current list includes three addresses outside @gwizweb.com. High-consequence actions additionally require a passkey confirmation valid for fifteen minutes.

Private database addressing

The STRUCTiO database has no public IP and is reachable only over a private address from inside the VPC. Sessions are signed with a Secret Manager key rather than a per-instance value, so a session is valid across instances and invalid after rotation.

Upfront System Analysis & Onboarding Fee

A one-time fee, paid before build work begins. It covers understanding the workflows you actually run, auditing the systems and integrations involved, reviewing data handling and access, and producing a written scope with a fixed price against it. Scope changes are re-quoted rather than absorbed silently.

Monthly Platform Licence Retainer

A recurring fee for the term of the engagement, covering the non-exclusive licence to use the running platform described above, together with hosting, monitoring and alerting, dependency and security updates, support and incident response. Billed monthly, and per seat where seats apply.

Why there is no per-feature menu

A published figure for a capability is either wrong or meaningless until someone has looked at the work. The same feature is a week against one intake process and a quarter against another, and quoting it as a line item moves the estimating risk onto whoever signs. Scope is established first, then priced once.

This is not a claim that no figure is ever published. A fixed entry fee for a defined tier does not vary with scope and can be stated honestly in advance; a menu a client could add up without anyone having examined their workflows cannot.

Currency

Prices are held in one currency as the source of truth. Checkout is presented and charged in your region’s currency, converted at the payment processor rather than against a rate table maintained here. That is regional checkout, not multi-currency accounting — the ledger side does not do multi-currency.

It returns a routing, not a price

The Estimator asks what intake arrives, whether any of it routes to a named assessor or adjuster, what happens to documents once they arrive, and roughly how many arrive in a month. From that it indicates a track — managed CMS, or enterprise cloud architecture — and states the reasons for it.

The rule is one rule: work implying a queue with decisions in it is enterprise work. A brochure site with a contact form is not, however many pages it has.

What it is not

It is not a quote and produces no figure. It does not price features: there is no per-feature cost model behind it to expose. And it binds neither party — nothing is committed until a written scope is agreed and signed.

The routing is computed in the browser for immediacy and again on the server, which does not trust the browser’s copy. Both results are recorded, so a disagreement between them is visible rather than silently resolved.

How a routing becomes an agreement

1. The Estimator indicates a track, with its reasons.
2. Enterprise-track work begins with the Upfront System Analysis & Onboarding Fee. No build price is issued before the analysis is done.
3. The analysis produces a written scope with a fixed price against it. That document, not the Estimator’s output, is the commitment.
4. On acceptance the Monthly Platform Licence Retainer begins, under the non-exclusive licence described above.

Sample documents you upload to it

Stored in a bucket in northamerica-northeast2 (Toronto), separate from the ReliAble Living secure intake store, deleted automatically after ninety days, and never made publicly accessible.

The form asks for blank templates rather than completed files, because it is an ordinary web upload and not the secure intake path. If a file containing client information is sent in error, tell us and it will be deleted.

Serverless containers on Cloud Run

Each service runs as a container that scales from nothing to a traffic spike and back, billed for the seconds it actually ran. There is no instance to patch, and no capacity decision to get wrong in advance.

Health-gated releases

A new revision is deployed with no traffic and a private tag, checked on that tag, and only then moved to serving. A release that fails its check is never reached by anyone, and rolling back is a traffic change rather than a redeploy.

Private network addressing

Databases carry no public IP and are reachable only over a private address from inside the VPC. Services reach on-premise equipment through an outbound tunnel, so no port is opened on your network for us.

Per-service identity

Each service runs as its own service account with secrets granted per secret where practical, so a compromise is bounded by that service’s grants rather than by a shared project identity. The accounts are listed in the isolation section above.