{"upl":"UPL-STM-26-799109-EN","title":"UplitAU_DEMI_Security_and_Data_Handling_Statement_v1_0_2026_10_02","author":"Skydle","publisher":"UplitAU Pty Ltd","environment":"real","payment_verified":true,"tier":"starter","payment":"eth","payment_ref":"0x45fb97b8992fedad43e4f7a8b691044d851c8f9fcfb20ad7771859efd2e7c7ea","amount_aud":"9.01","timestamp":"2026-10-02T10:43:45.110Z","registered_at":"2026-10-02T10:43:45.563Z","language":"en","file_name":"UplitAU_DEMI_Security_and_Data_Handling_Statement_v1_0_2026_10_02.docx","file_sha256":"33edea4da1dbca999ba26058bad9551d694199e85b4e2415a9c8494a09146b8d","extract_sha256":"13afdf66eee71cfacc91f9ada5cc50bc6f4916ad9a22532f18f4f2449cd5617d","derived_from":"UPL-AGR-26-120413-EN","description":null,"demi_core":{"core_statement":"UplitAU Pty Ltd (ABN 91 680 646 495), by Director Dr Dmitri Tcherkas, declares as at 2 October 2026 how DEMI Capsule and the DEMI Central Registry protect cryptographic keys, payments, and user data across ten specific security and data-handling commitments.","propositions":"S1: The registered file is hashed in the user's browser and never uploaded; only its SHA-256 is stored. | S2: Up to 6,000 characters of passage text is sent to the Anthropic API to form the Conceptual Core; only its SHA-256 is stored. | S3: User emails are used solely to confirm card orders and are removed server-side from every public view. | S4: Card details are handled exclusively by Lemon Squeezy. | S5: All API keys, the administrator token and anchoring key are held only as Cloudflare encrypted secrets, never in pages, files, chats or registrations; the Director keeps one offline encrypted copy and uses two-factor authentication. | S6: The server sets the price and verifies every payment at source; one payment registers one record. | S7: Anchoring uses a separate low-balance wallet, signs only if the key matches its address, observes a fee ceiling, and never blocks registration. | S8: The owner key is shown once and only its fingerprint is stored. | S9: Public text is screened server-side; known gaps are the main file name, non-Latin text and impersonation. | S10: The planned DEMI plugin and MCP tools are read-only.","constraints":"Applies to DEMI Capsule and the DEMI Central Registry as operated by UplitAU Pty Ltd (ABN 91 680 646 495) as at 2 October 2026. This is a self-description, not an independent audit and not legal advice. Scope is limited to the ten enumerated claims. Open items not yet resolved include: independent security review, Capsule terms and privacy policy, Privacy Act compliance status, AML/CTF question R1, migration to own domain, and appointment of a second administrator.","mechanisms":"S1: PARTY (browser-side hashing is not externally observable without audit) | S2: PARTY (API call content is internal; SHA-256 storage could be REGISTERED) | S3: PARTY (server-side removal requires internal inspection or audit) | S4: WEB (Lemon Squeezy public documentation confirms card-handling scope) | S5: PARTY (Cloudflare secret configuration is internal; 2FA status is internal) | S6: PARTY (server-side price and payment verification requires code or audit review) | S7: PARTY (wallet configuration and fee ceiling require internal or blockchain inspection; anchoring transactions: WEB via blockchain explorer) | S8: PARTY (key display logic is internal; fingerprint storage could be REGISTERED) | S9: PARTY (server-side screening logic is internal; known gaps are self-declared) | S10: PARTY (plugin and MCP tool read-only status requires code review; not yet released)","boundaries":"The statement does not constitute an independent security audit, legal advice, or regulatory certification. It does not address Privacy Act compliance (acknowledged open item), AML/CTF obligations (open item R1), or Capsule terms and privacy policy (not yet published). It does not cover data retention periods, breach-notification procedures, or data residency. It does not bind Anthropic, Lemon Squeezy or Cloudflare. Any amendment or resolution of open items should be registered as a new DEMI record citing this UPL as Parent. GAPS: No dates are given for resolving open items; Privacy Act and AML/CTF compliance status are explicitly unresolved; the own-domain migration timeline is unstated; second-administrator appointment is undated."},"core_withheld":false,"core_publication_basis":"Self-registration: UplitAU registering its own work from its own wallet. The author is known to the Registry operator because they are the same party; the Ethereum payment itself identifies no one.","costs":{"claude_aud":null,"openai_aud":null,"service_aud":null,"total_aud":null},"landing_page":"https://registry.demicapsule.com/registry/UPL-STM-26-799109-EN/index.html","visibility":"listed","product":"capsule","core_requested":true,"provenance_manifest":null,"activation_reference":"DEMI:1042:UPL-STM-26-799109-EN:P","ai_fetchable":true,"amount_eth":0.002156,"payment_value_aud":9.02,"payment_rate_aud_per_eth":4182,"payment_rate_source":"etherscan ethprice","core_sha256":"2ccff0ee086ff6bd5f7c8a64527809a4645934ecba0e6fe563ea903f00e05134","anchor_tx":"0x5ae4566ec3bbcb971e7d59ecb9d4bd8d55dce87a4f2e86a785426171b3f767b3","anchor_submitted_at":"2026-10-02T10:43:51.701Z","anchor":{"status":"confirmed","tx_hash":"0x5ae4566ec3bbcb971e7d59ecb9d4bd8d55dce87a4f2e86a785426171b3f767b3","etherscan_url":"https://etherscan.io/tx/0x5ae4566ec3bbcb971e7d59ecb9d4bd8d55dce87a4f2e86a785426171b3f767b3","block_number":26104120,"block_time_utc":"2026-10-02T10:43:59.000Z","submitted_at":"2026-10-02T10:43:51.701Z","digest":"c4df1e57799b7dd38b4afaad9d7bf5ae4282f7316b7acbcfe52f56ea370ad7da","snapshot_url":"https://registry.demicapsule.com/registry/anchor/c4df1e57799b7dd38b4afaad9d7bf5ae4282f7316b7acbcfe52f56ea370ad7da.json"}}