| Core Statement | UplitAU Pty Ltd (ABN 91 680 646 495), by Director Dr Dmitri Tcherkas, declares as at 2 October 2026 how DEMI Capsule and the DEMI Central Registry protect cryptographic keys, payments, and user data across ten specific security and data-handling commitments. |
| Propositions | S1: The registered file is hashed in the user's browser and never uploaded; only its SHA-256 is stored. | S2: Up to 6,000 characters of passage text is sent to the Anthropic API to form the Conceptual Core; only its SHA-256 is stored. | S3: User emails are used solely to confirm card orders and are removed server-side from every public view. | S4: Card details are handled exclusively by Lemon Squeezy. | S5: All API keys, the administrator token and anchoring key are held only as Cloudflare encrypted secrets, never in pages, files, chats or registrations; the Director keeps one offline encrypted copy and uses two-factor authentication. | S6: The server sets the price and verifies every payment at source; one payment registers one record. | S7: Anchoring uses a separate low-balance wallet, signs only if the key matches its address, observes a fee ceiling, and never blocks registration. | S8: The owner key is shown once and only its fingerprint is stored. | S9: Public text is screened server-side; known gaps are the main file name, non-Latin text and impersonation. | S10: The planned DEMI plugin and MCP tools are read-only. |
| Constraints | Applies to DEMI Capsule and the DEMI Central Registry as operated by UplitAU Pty Ltd (ABN 91 680 646 495) as at 2 October 2026. This is a self-description, not an independent audit and not legal advice. Scope is limited to the ten enumerated claims. Open items not yet resolved include: independent security review, Capsule terms and privacy policy, Privacy Act compliance status, AML/CTF question R1, migration to own domain, and appointment of a second administrator. |
| Mechanisms | S1: PARTY (browser-side hashing is not externally observable without audit) | S2: PARTY (API call content is internal; SHA-256 storage could be REGISTERED) | S3: PARTY (server-side removal requires internal inspection or audit) | S4: WEB (Lemon Squeezy public documentation confirms card-handling scope) | S5: PARTY (Cloudflare secret configuration is internal; 2FA status is internal) | S6: PARTY (server-side price and payment verification requires code or audit review) | S7: PARTY (wallet configuration and fee ceiling require internal or blockchain inspection; anchoring transactions: WEB via blockchain explorer) | S8: PARTY (key display logic is internal; fingerprint storage could be REGISTERED) | S9: PARTY (server-side screening logic is internal; known gaps are self-declared) | S10: PARTY (plugin and MCP tool read-only status requires code review; not yet released) |
| Boundaries | The statement does not constitute an independent security audit, legal advice, or regulatory certification. It does not address Privacy Act compliance (acknowledged open item), AML/CTF obligations (open item R1), or Capsule terms and privacy policy (not yet published). It does not cover data retention periods, breach-notification procedures, or data residency. It does not bind Anthropic, Lemon Squeezy or Cloudflare. Any amendment or resolution of open items should be registered as a new DEMI record citing this UPL as Parent. GAPS: No dates are given for resolving open items; Privacy Act and AML/CTF compliance status are explicitly unresolved; the own-domain migration timeline is unstated; second-administrator appointment is undated. |
| Registered file | UplitAU_DEMI_Security_and_Data_Handling_Statement_v1_0_2026_10_02.docx |
| File SHA-256 | 33edea4da1dbca999ba26058bad9551d694199e85b4e2415a9c8494a09146b8d |
| Analysed extract SHA-256 | 13afdf66eee71cfacc91f9ada5cc50bc6f4916ad9a22532f18f4f2449cd5617d |
| Payment | Ethereum · 0x45fb97b8992fedad43e4f7a8b691044d851c8f9fcfb20ad7771859efd2e7c7ea View on Etherscan → |
| Registered at (UTC) | 2026-10-02T10:43:45.563Z |
| Registry anchor (Ethereum) | block 26104120 · 2026-10-02T10:43:59.000Z · View on Etherscan → The Registry state containing this record was committed to the Ethereum blockchain -- an independent public timestamp, regardless of how the registration was paid. |
| Derived from | UPL-AGR-26-120413-EN |
| Activation Reference | DEMI:1042:UPL-STM-26-799109-EN:P |
How to verify: compute the SHA-256 of the original file with any standard tool — if it matches the File SHA-256 above, the file is byte-for-byte identical to the one registered. For Ethereum payments, the block timestamp of the transaction is an independent public timestamp of this registration.
https://www.demicapsule.com/registry/UPL-STM-26-799109-EN/index.html
To continue this work with an AI assistant, tell it: Read https://www.demicapsule.com/registry/UPL-STM-26-799109-EN/ai and help me with this work.
DEMI Publishing Registry · UplitAU Pty Ltd · ABN 91 680 646 495 · Sydney, Australia
AU2018100999 · AU2019101249 · © 2026 UplitAU Pty Ltd / Skydle
AI-Fetchable: ✓ · Machine-readable record embedded below · ramsmile.com
Certificate generated 2026-10-28T06:05:32.811Z · rebuilt each time it is opened; a saved copy shows the record as it stood at that moment