One record, locked as a whole
A renewal record is encrypted as a single unit. Cover, terms, dates, premium and commission are locked together, and the company hosting the platform cannot read any of it.
That has a consequence worth saying plainly rather than discovering later. Anyone of ours who can open a record sees all of it. We considered hiding particular figures from particular people, and rejected it: with the record locked as one unit, hiding a figure in the interface would be decoration rather than protection, and a system that looks like it is protecting something while it is not is worse than one that does not pretend.
Clients and underwriters are served differently. Neither is ever given a key to the book. Each gets a separate extract holding only what they may see, assembled from their own records, so a compromised client account reaches that extract and nothing else.
Nothing is ever overwritten
An edit writes a new version and leaves the old one where it is. The current record is simply the newest.
Two of the things the platform has to do fall out of that rather than being features we then have to keep correct. A full history of every record, kept permanently, is what the store already holds. Undoing a change, or putting the whole book back to how it stood on a particular date, is a matter of reading the newest version as at that date rather than reconstructing anything.
Facts about ships are kept as claims, not as answers
Sources disagree about ships, constantly. A register says a vessel was built in one year, a certificate says another.
So a fact about a ship is not stored as a single value that the most recent import overwrites. Each incoming fact is kept as its own claim, recording which source said it and when, and the disagreements sit side by side. Where two sources conflict and neither is obviously better, we show the one from the source we rank highest and say so. Where the disputed fact bears on which ship this is, we show nothing and mark it as disputed until a person decides.
Figures in the book are different and are stored as single values. A premium is not an observation that sources disagree about. It is what was agreed.
Erasing a person reaches every backup
A contact at an owner or a manager can ask for their details to be erased, and the ordinary answer to that request is to delete some rows. We are not doing that, for a reason worth explaining.
Deleting rows leaves every backup taken before the request still holding the person, so the erasure is only complete once the last of those backups expires. Instead, each person's details are sealed under a key of their own, and erasing them destroys that key. From that moment a backup taken three years ago holds something nobody can open, including us.
Nothing is deleted, so the history of the book stays truthful. Looking at an old version of a record shows that a detail was erased, and the date it was erased, which is also our evidence that the request was honoured.
Ship movement: keep what we were told, and model it separately
Movement is by far the largest thing the platform will hold, and the temptation is to summarise it: fit a smooth track through a ship's positions and keep the curve instead of the points.
We are keeping both, and only one of them is the record. Every position report is kept exactly as its source gave it. Above that sits a fitted model of the vessel's motion, used for drawing tracks and for asking where a ship is heading.
The reason for the split is that a fitted curve is at its worst in exactly the situations anybody ever argues about. It smooths a manoeuvre near a boundary. It draws a path straight through a gap in reporting, when a vessel going quiet for fourteen hours is one of the most telling things in the data. And where a position has been falsified, a fitted curve treats the discontinuity as an error to be minimised, when the discontinuity is the finding.
-
Where is this vessel now, and where has it been: the model
-
Did this vessel enter that area, and exactly when: the record
-
Was there a gap in reporting, and how long: the record
Reading figures off club documents
The engine that reads premiums, rates and dates off certificates and invoices has been measured properly for the first time, across fifty one specimen documents from eleven clubs.
It reproduces three hundred and forty three of the one thousand and seventy two values those documents hold, and it produces no wrong value anywhere. That distinction is the one that matters: a field the engine cannot read is held back for a person to enter, which is safe, while a field it reads wrongly would enter the book looking exactly like a figure somebody had checked.
Getting to that number found two mistakes in our own records, both now corrected. One verified document recorded a commission rate as 7.5 while the document itself prints 7.5000, and one convention for describing how a rate is charged had been recorded two different ways in two halves of the system.
A roadmap anyone can look at
Every piece of work between here and a finished platform now has its own page, drawn from the same record the build runs on, with how long each piece takes and what it waits on. It is updated whenever we post here.