# Qurmmius external review intake

Status: preparation only. No attorney or security assessor has been engaged; no external review has been completed. Do not describe either product as legally approved, security certified, or production-ready.

## Legal/product review — ClearGrant Trust Profile

Request a written scope from a Pennsylvania business/privacy/technology attorney covering:

- Whether “Trust Profile,” product positioning, website language, checklists, or sales materials imply investigation, certification, creditworthiness, funding eligibility, or a funding recommendation.
- Privacy notices, consent, data minimization, retention, correction/deletion rights, breach handling, and Netlify/Supabase/provider roles.
- QI authentication/account boundaries, encrypted account-copy key custody/rotation, audit-log retention, and user deletion workflow.
- Terms and representations for intended customers and whether any future scoring or verification feature changes the legal analysis.

Suggested low-cost starting paths to contact and independently qualify:

- Pennsylvania Bar Association Lawyer Referral Service: https://www.pabar.org/PBA/Public-Resources/Find-a-Lawyer.aspx (the current page lists an initial 30-minute consultation for no more than $30; ask about later fees and written scope).
- Penn Carey Law Detkin IP & Technology Legal Clinic: https://www.law.upenn.edu/live/news/18141-using-law-to-support-innovation (free clinic work is described for qualifying technology ventures, but current intake, eligibility, timing, and scope are not guaranteed).

## Security review — ContextKey Shield and ClearGrant storage

Ask CISA whether its no-cost Cyber Hygiene web-application scanning is available for the Qurmmius public site and which assets/scope it can assess: https://www.cisa.gov/cyber-hygiene-services. CISA's service is a useful external scan, but is not represented here as a complete source-code review or penetration-test certification.

For a code-level assessment, obtain a written quote/rules of engagement from an independent web/API application-security assessor. Use staging only and ask for:

- Review of the ContextKey Edge proxy and ClearGrant account-storage function against `CONTEXTKEY-INDEPENDENT-SECURITY-REVIEW-20260926.md`.
- Authorization/session and per-account isolation tests; CORS and origin tests; request-size/schema validation; secret/PII handling; quota concurrency and provider-spend limits; encryption/key-loss/rotation; logs, retention, deletion, and dependency/configuration review.
- A written report with severity, reproduction evidence, remediation recommendations, retest results, environment/scope, and limitations.

Never disclose production API keys, QI signing secret, encryption key, or customer data as part of intake. Create short-lived least-privilege staging credentials only after the assessor's identity, contract, data handling, and secure transfer channel are approved.

## Qurmmius Code Preflight

Qurmmius Code Preflight is limited to local heuristic code/configuration checks; contract and record analysis, redaction, and QI provider analysis are out of scope. It does not execute code, certify security, or establish compliance. See [`QCS-EXTERNAL-REVIEW-INTAKE-20260926.md`](QCS-EXTERNAL-REVIEW-INTAKE-20260926.md) for the technical, legal/privacy, and accessibility review scope. Use sanitized or synthetic samples, not live secrets or customer data.

## Draft outreach (do not send until reviewed)

Subject: Independent product/privacy review request — ClearGrant Trust Profile

Hello,

I am seeking a scoped review of Qurmmius LLC's ClearGrant Trust Profile, a metadata evidence organizer with an owner-attestation checklist and an optional encrypted account copy. It does not automatically validate records or determine grant, credit, or legal eligibility. I have a concise product-boundary and question packet available. Could you confirm whether you handle Pennsylvania technology/privacy work, whether this matter fits your intake criteria, your earliest availability, and the cost for a written review?

Thank you,
Christopher Quinn