Owner · Payments Team
Trust by design
Know who said it: a person or a tool.
Topoloom keeps human declarations, machine suggestions, bindings, and provider-verified context distinct—across authoring, review, publication, and export.
Human-authoredDeclared ServicePayment Service
External contextObserved differenceRuntime owner differs
Suggested — not declared
Authored stateAttributed context
Independent assurance
ISO/IEC 27001:2022 certified
Topoloom’s information security management system is certified to ISO/IEC 27001:2022. The product controls below are separate from that certification. Test each one in your evaluation.
Knowledge-state legend
Trust has more than one axis.
Authorship, version lifecycle, and external context answer different questions. Each state uses words, a mark, and a pattern—not color alone.
Authorship
What has a person actually confirmed?
Free-form
Readable working content that declares nothing yet.
Visual only
A connector or node drawn for explanation. It declares no relationship.
Suggested — not declared
A proposal shown for review. Nothing changes until an authorized person accepts it.
Declared
Confirmed by an authorized person.
Reference
A pointer to one reusable object. It carries the identity, never a copy of its properties.
Version lifecycle
Which intentional version is current?
Published
An immutable artifact version explicitly published through the publication workflow. Creating a version alone does not publish it.
Superseded
Preserved history that is no longer current.
External context
What comes from a named provider?
Bound
A local declaration linked to a provider record. The link neither merges provider data into authored content nor verifies the declaration.
Verified by provider
Explicitly asserted by a named provider at a stated time. This is the provider’s claim, not independent verification by Topoloom.
Confirm the declaration
Keep human intent in control.
Suggestions stay suggestions until an authorized person confirms what should enter authored knowledge.
Enterprise controls you can inspect
Control changes. Keep decisions traceable.
Inspect who can change knowledge, which version a decision applies to, and what integrations may access. Test these controls in the environment your team will use.
Human decisions
Suggestions, imports, and provider observations do not become human-approved declarations automatically. An authorized person must accept an authored change. AI and integrations cannot silently change authored or published knowledge. AI cannot approve a review or publish.
Permission-aware surfaces
Workspace isolation and current permissions are checked before anything is read for search, graph views, export, integration events, or provider access. Search results, references, reviews, and generated views show only what the reader is allowed to see. Restricted knowledge is not retrieved first and filtered afterward.
Immutable versions
Documents, content nodes, objects, relationships, and versions each keep their own stable ID as they change. Published artifact versions never change and can be referenced by ID. Each keeps its provenance, the record of where its content came from, with its review, audit, and contract context.
Retention and lifecycle
Archive, restore, supersession, retention, and deletion stay explicit and auditable, including the tombstone left behind when an item is removed.
Public integration contracts
First-party and third-party consumers use the same versioned APIs, events, and permission boundary. Integrations cannot bypass these contracts through privileged direct database access.
External data stays separate
A binding links records; it does not verify them. Provider observations, evidence, and credentials remain outside authored document state.
Living Bindings place information from an external system beside your writing. The tested reference workflow uses a simulated provider; confirm any real connector separately.
Designed to fail safely
When a dependency fails, your team can keep writing.
Each row assumes Topoloom itself stays available. Test outages of Topoloom, the login provider, and your network separately. Working without an outside provider does not mean Topoloom works offline.
| Condition | What keeps working | What is suppressed or labeled |
|---|---|---|
| AI or model service unavailable | Authoring, collaboration, permissions, review, publication, export, and Knowledge Review suggestions, whose current fixed rules call no AI model | Model-assisted features, where offered, are unavailable. Nothing is generated in their place |
| Context provider unavailable | Writing, collaboration, review, publication, history, semantic diff, and local export | Provider data may be stale or missing. It stays outside authored content |
| Search index or graph views unavailable | Saved work and immutable versions, which PostgreSQL stores as the authoritative record | Search results and graph views may be incomplete until they rebuild. They never replace that record |
| Permission revoked | Only source content the reader still has permission to read, including its non-sensitive reference text | The restricted target and cached provider details are hidden without revealing whether the target exists |
Portable knowledge
Readable by people. Inspectable by machines.
A scoped export can carry readable artifacts and machine-readable records: IDs, versions, relationships, provenance, reviews, and permission mappings. Inspect its report for omissions, redactions, and remappings. The example below is an illustrative subset, not a complete inventory.
Source-linked Diagram exports use topoloom.package/4. Older formats remain readable. Check the format, included sources, and omissions in your own package.
manifest.jsonScope and formatartifacts/<artifact-id>/current.mdReadable artifactobjects/<object-id>/versions/<version-id>.jsonVersioned objectpermissions/mappings.jsonPermission mappingreports/export.jsonOmissions and remappings
Test these boundaries with your team’s permissions, provider, and export scope.
Request a demo