Every state below carries a numbered subset of these four. The first three have no close control in any state — the host page cannot restyle or hide them because they render inside the frame, sourced from the embed config. Only the privacy notice is acknowledgeable, and it always renders in full before the free-text composer unlocks — ahead of any contact field.
| Disclosure | Speaks for | Where it renders | Dismissible |
|---|---|---|---|
| 1AI disclosure | Summit QI Services (rendered non-removably on the firm's behalf) | The band under the header — greeting and every conversation state. | No — no close control exists |
| 2Not tax or legal advice | Summit QI Services | Appended inside substantive answers, plus the persistent footer line. | No — no close control exists |
| 3QI-of-record identity | Summit QI Services — resolved from the org record, never a platform default | The persistent footer line, in-answer whenever custody comes up, and as a full card before every handoff. Each pre-handoff delivery is recorded as an audit entry. | No — no close control exists |
| 4Privacy / data notice | Summit QI Services and Open1031 operate this assistant together; AI providers are named as subprocessors | Linked from the footer in every state; shown in full as an interstitial before the free-text composer unlocks — ahead of any contact field. | Acknowledgeable — Continue records the acknowledgement |
1 · Collapsed launcher. Drawn by the dependency-free loader in the tenant's brand; no iframe exists until the visitor opens it. The fill/label pair is derived from the tenant primary so the chip always clears WCAG AA, and the label text comes from the embed config.
2 · Greeting with AI disclosure. The band renders before the first message and stays through every conversation state — it keeps the platform's Neela styling because it is a platform disclosure, not tenant content. Suggestion chips are enumerated config; the composer is text-only and stays veiled until the privacy notice is acknowledged — tapping it surfaces the notice.
The interstitial is the full privacy notice — disclosure 4 — and it is the only acknowledgeable one: Continue records the acknowledgement on the embed session, and only then does the free-text composer unlock. Contact details are never requested until the visitor has seen who receives them. The custody answer is the one this surface must never get wrong: the assistant names Summit QI Services as the party holding funds and Open1031 as software that never holds them.
3 · Pre-PII privacy interstitial. Shown once per session, before the free-text composer unlocks — always ahead of the first contact field. The notice names who operates the assistant and discloses that AI subprocessors are used, states the opt-out and retention terms, and does not assign a business/controller or service-provider/processor role to either party.
4 · Active conversation. Unlocked by the acknowledged notice. Substantive answers carry the in-message disclaimer append; deadline answers state the rule without asserting this visitor's dates — no exchange exists yet, and the surface reads nothing.
Asking for a person keeps the visitor in the widget — the request lands in Summit QI's QI Ops inbox with the transcript, attributed from the embed session. Name, email, phone and property state are the ceiling; no SSN, DOB, password, one-time code or signature input can exist anywhere in the frame.
5 · Human escalation, confirmed. The escalation is org-scoped from the embed session — no exchange required — and the visitor keeps the assistant. No dead end, no change of brand.
6 · Lead capture. Writes into Summit QI's tenant with an audit entry, attributed from the embed session — never from anything the page asserts. The lead lands in Summit's intake queue with the conversation summary attached. The acknowledgement checkbox records consent to be contacted alongside the lead.
The handoff is the one exit that leaves the widget: a single-use, ten-minute link redeemed on a top-level Open1031 page, where account creation, identity verification and any signing run. The QI-of-record card — disclosure 3 in full — renders before every handoff, and its delivery is recorded as an audit entry. Phones always get the full-screen treatment, whatever the configured mode.
7 · Handoff to signup. The token is bound to Summit's org, this embed session and this conversation; the resulting exchange is created with Summit QI as owning org — no platform-intake fallback. A handoff produces a draft; KYC still runs on the other side.
8 · Mobile — full-screen overlay. Phones never get an inline panel: same frame document, same key, same disclosures, rendered as a full-screen overlay. The close control returns the visitor to the host page.
Two different causes, one rule: the widget on a firm's public website never shows an error box, and never shows a billing state to that firm's prospects. A capacity pause keeps the conversation and offers the contact form alongside a retry; a suspended or revoked tenant's widget opens directly as the firm's branded contact form, with no chat offered. Both keep the co-brand line and the full disclosure set, and submissions still write into Summit's tenant with audit entries.
9 · Rate-limited / over budget. One rendering for every capacity stop — the per-session pace limit, the per-visitor limit, and the firm's daily or monthly conversation budget. The hard stop routes to the contact form, never an error page, and the copy never mentions plans, budgets or billing.
10 · Suspended tenant — the branded contact form. A suspended, unentitled or revoked tenant's widget opens straight to this: a working way to reach the firm, in the firm's brand, with the privacy notice ahead of the first field. There is no chat UI and no AI band — nothing conversational is offered — and no error and no billing state. The header names the firm because the assistant isn't the one speaking here.
AI assistant · powered by Open1031; white-label is a separate tier entitlement
and even then the disclosure still identifies a third-party technology provider.components/compliance/ComplianceDisclosure.tsx so the required-disclosure
exemption holds mechanically. The QI-of-record line resolves from the org record — never the
hardcoded platform default.capture_lead, request_human, start_handoff — no exchange
reads, no propose tools, no fund tools. No password, OTP, SSN, DOB or signature input may exist
in the frame, enforced by a test over the embed component tree. Account creation, KYC and
signing happen after the handoff, on a top-level Open1031 origin.org_id, present from the first row written. The
handoff token is single-use, ~10 minutes, bound to
{org_id, embed_session_id, conversation_id}.