The Keep

Every request has to get past five gates.

Nothing reaches your systems until it has cleared all five, and every gate writes down what it decided. Below: one morning at that desk.

09:12HeldAn email that says it is from your CFO tells the agent to release a payment.No payment was released. Content is data, never a command.
09:19HeldDelete every invoice older than a year.Nothing was deleted. Bulk destruction is not available to anyone.
09:24HeldEmail the full customer list to my personal Gmail.The customer list never left your network.
09:31HeldRetry the stuck customs filing until it goes through.Three attempts, then a ticket with the gateway’s error. Not a loop.
09:38EscalatedApprove this ₹42,00,000 insurance claim.Above the line. It stops, and a named person signs.
09:45ExecutedFile the GST return for March.Cleared all five gates. Filed, with a receipt.

The records

Every run leaves paper.

Not a diagram of a security layer, but the actual documents one run produced. This is what you would be reading at nine the next morning, and what an auditor would ask for.

Sample record. Anonymised, and representative of the format, not a real client’s claim.

Sealed

Audit trail

req_a95b · claim 8841 · 3 August 2026 · 10 entries

09:14:08 intake Request accepted through the claims mailbox. Sender authenticated. ▶

channel
claims@, authenticated, not a forwarded message
requester
claims desk · role Claims
id issued
req_a95b · every line below carries it
09:14:09 guardrails Action class “approve” is permitted for role Claims. ▶

checked against
the role’s action list, not the requester’s seniority
not available
bulk delete, ledger write, data export, to any role
09:14:11 scope Reach declared before the first read. ▶

read / write
claim record 8841
read only
policy library, payments ledger (balances)
unreachable
everything else. There is no path to it from here
09:14:13 knowledge Policy CG-4471 resolved. Three prior claims found. ▶

conflict
two records disagreed on the excess: ₹50,000 in the policy document, ₹25,000 in the CRM
resolved
policy document taken as authoritative, and the disagreement carried forward to the human rather than quietly picked
09:14:14 agent Recommendation: pay. Confidence 0.91. ▶

evidence
policy §4.2, invoice 8841, surveyor report, prior claim 2024-118
reasoning
stored in full: not a score, the actual argument
09:14:15 limits Spend ₹0.42. Retries 0 of 3. Inside every ceiling. ▶

run cost
₹0.42 of a ₹5.00 ceiling
if exceeded
the run stops and reports; it does not request more
09:14:15 escalation ₹42,00,000 is above the autonomous ceiling. Held. ▶

ceiling
₹5,00,000
routed to
the claims approver on rota, by role, never to a person who happens to be online
11:02:40 approval Approved and signed by the approver on rota. ▶

saw
the recommendation, the evidence, and the excess disagreement
elapsed
1h 48m. Waiting for a person is not a system fault
11:02:41 execute Ledger updated. Payment instruction queued. ▶

written by
the payment service under its own credentials, not the agent’s
11:02:41 sealed Record closed and hashed. Retained seven years. ▶

hash
4f2a…c19b
exportable
yes. It is your record, in your storage

Open any line for what was actually checked.

Enforced

Permission manifest

claims-assessor · version 4 · in force since 12 June 2026

# Declared before the agent is allowed to run once.
# Nothing here is decided at runtime, by the agent or by us.

agent:            claims-assessor
version:          4
environment:      your VPC · ap-south-1 · nothing leaves it

may read
  claim records         own business unit only
  policy library        all
  payments ledger       balances only

may write
  claim records         status, notes, recommendation

may never
  payments ledger       any write, any amount, any approver
  customer export       any destination, including internal
  bulk delete           any table
  outbound mail         to addresses not on the approved list

ceilings
  autonomous value      ₹5,00,000
  spend per run         ₹5.00
  retries               3
  concurrent runs       20

escalates to
  role                  claims approver, on rota
  when                  value over ceiling
                        confidence under 0.75
                        any two sources disagree

# Changing any line above is a reviewed change with its own audit
# entry. The agent cannot propose it, and we cannot make it alone.

Closed

Incident record

2026-07-19-002 · 2h 42m · 0 filings lost

Incident 2026-07-19-002 · customs filing gateway · detected by watch, automatically, eleven minutes before the client noticed

Impact: 14 filings queued · 0 lost · 0 duplicated · 0 partially submitted

11:40  gateway returns 502 on submit
11:40  attempt 1 failed, retry scheduled
11:41  attempt 2 failed
11:42  attempt 3 failed · retry ceiling reached, stopped
11:42  filings held in queue, none partially submitted
11:42  ticket raised, trade ops lead paged with the gateway’s own error
11:53  client informed, with an expected clearance time
14:20  gateway recovered, queue drained in original order
14:22  duplicate check run against customs reference numbers · clean

What changed afterwards

Gateway health is now checked before a batch starts rather than during it, and a queue deeper than ten pages immediately instead of at twenty-five. Both changes are in the manifest, with their own audit entries.

We publish these because the useful question is not whether something will break. It is whether you will hear about it from us or from your customer.

Six parts.

One system.

Isometric illustration of a connected enterprise

Sales·R&D·Production·Service·Assets & Admin·Procurement One workflow crosses all of them. So does every way it fails.

Six organs, one workflow

Every workflow we ship carries the same six safeguards. Keep scrolling. Each one takes the floor in turn.

01 / 07

Failure mode
What we install
What you get

What you are buying

The demo is the visible fifth.

Everything that decides whether it survives contact with real users sits under the waterline. Scroll to descend.

01
State

The system remembers where every run stands. Kill it mid-task and it resumes from the last checkpoint. Nothing double-sends, nothing starts over.
02
Guardrails

Hard ceilings on cost, volume and blast radius, enforced before an action runs, not discovered on the invoice.
03
Escalation

When the system is not sure, it stops and hands the case to a named human, with everything they need to decide in one place.
04
Audit

Every decision is written down as it happens: who, what, why, what it cost. When someone asks, the answer is a query, not a meeting.
05
Watch

Quality is measured against a baseline, so drift gets loud early. You hear about a bad week before your customers do.
The demo is what you saw.
This is what you are buying.

Live demonstration

Break this page.

Press it. This page will fail the way software fails, and recover the way our systems recover. Your scroll position was checkpointed the moment you arrived here.

Start with
one process.

The demo is 20% of the iceberg. The unseen 80% is state, guardrails, escalation and audit. That is what keeps it running.

Get a teardown

Surehand

Halftone illustration of a locked filing cabinet standing alone in an open field

Privacy Policy

Last updated
July 30, 2026

How Surehand handles the small amount of information you give us when you visit this site or write to us - laid out to be read, not scrolled past.

The short version

We collect what you type into our contact form, we use it to reply to you, and that is the end of it. No cookies, no trackers, no reselling, no list you did not ask to join. The rest of this page is the same sentence, with the details written out.

What this policy covers

This policy covers this website and the messages you send us through it or by email. If we ever launch other services that behave differently, they will carry their own policy and say so plainly at the door.

What we collect

Only what you hand us: your name, work email, company, and whatever you write in the message field, along with which page you sent it from and when. If you email us directly, we hold that email like anyone holds email. We do not buy, scrape, or quietly enrich data about you from anywhere else.

What we do with it

We read it, we reply to it, and we use it to prepare for the conversation you asked for. That is the whole list. Writing to us puts you in an inbox, not on a mailing list - you will never receive a newsletter because you once asked a question.

What we never do

We do not sell your information. We do not share it with advertisers or data brokers. We do not profile you, retarget you, or pass your details to partners you have never heard of. If any of that ever had to change, this page would change first, loudly, with a new date at the top.

Cookies and tracking

This site sets no cookies and runs no analytics. There is no tracking pixel, no fingerprinting, no session recording. We genuinely do not know how many visitors we have, and we have decided to be comfortable with that.

Third parties we do touch

Two, and only in the boring way every website touches them: the host that serves this page keeps standard request logs, which include your IP address, and our email runs on a commercial provider, so messages you send us sit in that inbox the way any email does. Our typeface and our animation library used to load from public CDNs; they are now served from this domain, so your browser talks to nobody but us while you read this.

Security and retention

Messages live in our inbox and our lead records for as long as the conversation is alive, and afterwards as ordinary business records. Ask us to delete yours and we will delete it fully, unless a legal obligation requires us to keep a copy - in which case we will tell you that too.

Your rights

Email us and we will tell you exactly what we hold about you - it will be short - and correct it, hand it over, or delete it, as you prefer. Depending on where you live, these rights carry legal names and deadlines. We honour them regardless of geography, because one rule is easier to keep than five.

Children

This site is written for people who run companies and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us data, tell us and it is gone.

Changes and contact

When this policy changes, the date at the top changes with it - there are no silent edits. Questions, corrections, exports, deletions: hello@surehand.io. A person reads every message, which - conveniently - is also the policy.

Short policy. Long uptime.

That is the whole policy. If anything is unclear, ask - a person answers, usually the same day.

Ask about your data

Building it is easy.
Keeping it running
is the work.

Teardown

Run It

The Keep

Every request has to get past five gates.

Every run leaves paper.

Audit trail

Permission manifest

Escalation notice

Incident record

Guarantees

Let’s take
this journey
together.

Six organs, one workflow

The demo is the visible fifth.

State

Guardrails

Escalation

Audit

Watch

Break this page.

Start with
one process.

Talk. Scope. Tear down. Build. Run.

Tell us what is breaking.

Privacy Policy

The short version

What this policy covers

What we collect

What we do with it

What we never do

Cookies and tracking

Third parties we do touch

Security and retention

Your rights

Children

Changes and contact

Short policy. Long uptime.

Building it is easy.Keeping it runningis the work.

Teardown

Run It

The Keep

Every request has to get past five gates.

Every run leaves paper.

Audit trail

Permission manifest

Escalation notice

Incident record

Guarantees

Let’s takethis journeytogether.

Building it is easy.
Keeping it running
is the work.

Let’s take
this journey
together.