Security
What is collected, what is kept, and who can change it.
Public sources only
The public corpus is built from sources that publish to anyone without credentials. Each adapter records its rights text. Items are stored with their canonical URL and hash; the site does not republish full articles beyond what the dossier needs to show a claim's span.
Three clocks, kept apart
Published, observed, and collected times are stored separately. An assessment states which one it used. This is a security property as much as an analytic one: it prevents a late repost from backdating an event.
Read-only in public
Every public route is a GET over a snapshot. The image check fetches one URL you supply, computes hashes and reads embedded credentials, and discards the bytes. It is rate limited and same-origin.
Decisions are attributed
Changing an event's status requires a lab identity. Each decision stores the actor, the justification, the assessment version it was made against, and the time. Machine output is never overwritten; the decision overlays it.
Sources that fail are visible
A source that times out or returns nothing is recorded in the run with its error. The source registry shows last-run outcomes. Disabled and planned sources never appear in the corpus.
Customer deployments
A customer-operated FUSE runs in the customer's environment with the customer's adapters and does not send collected material to Dead Index.
What is not claimed
No FedRAMP authorization. No CMMC certification. No facility clearance. The support index is a heuristic, not a probability. Detector outputs are weak signals, not verdicts. Do not send classified or export-controlled material through any form on this site.