Build contract — document lineage, templates and storage
1 · A version is a row, never a file overwrite. Every save writes a new version with its author, timestamp,
content hash and reason. Nothing is purged — not superseded drafts, not retired templates. Retention is permanent for the life of
the exchange record, and the version table is the single source both this surface and the workspace
Documents tab read.
2 · Signature seals the version. Once a version is signed, the edit and restore paths close on that version and stay
closed. A later change creates an
amendment that references the sealed version and names the clauses it modifies; it never
replaces it. Both documents ship in every export and both are cited in the audit trail. Under the eSign Act and UETA the record is what
the signer assented to, so each party signs with their own credentials —
no surface may offer a "sign on behalf" affordance,
and no staff role may mark another party's signature or KYC as satisfied.
3 · Restore is additive and audited. Restoring version N creates a new head that is a copy of N; the intervening
versions remain. The restore requires a typed reason and writes an immutable audit entry with the actor, source version and reason.
Restore is refused on any sealed version and once the exchange is archived.
4 · Documents never move a statutory date. The 45- and 180-day clocks come from the exchange record. A date can be
adjusted only through an approved two-person override carrying a legal basis (IRS relief notice, for example) — never by editing a
document, and never by a single user. An overdue clock renders as overdue everywhere it appears; no view may show it as satisfied.
5 · Templates version forward only. Publishing v3.3 does not regenerate the 1,284 documents made from v3.2. Retiring a
template stops new use and deletes nothing, because a filed document must stay reproducible from the exact version that made it.
Publication requires a named approver who is not the author — the same two-person rule that governs a disbursement.
6 · Merge fields are typed, sourced and policed. Each field declares its type, whether it is required and where it
resolves from. A required field with no source blocks the render rather than emitting a blank into an agreement. Full TINs and dates of
birth are not addressable as merge fields at all — masked variants only — because the sensitive-profile table is not a template data
source.
7 · Jurisdiction is a routing rule, not advice. State applicability attaches the addendum the QI's counsel authored. A
state with no published block still generates on the base template and flags the file for counsel review; the platform never silently
omits a required disclosure.
8 · The external store is a mirror by default, and the record never leaves. The audit trail, signed originals and
signature certificates, version history with hashes, and all identity/KYC artifacts stay in Open1031 in every mode. Signed documents
push read-only and are never read back. NPI-bearing categories stay blocked until a vendor assessment and a safeguards contract are on
file — a GLBA Safeguards Rule obligation the connection screen enforces rather than describes. Conflicts default to a human decision;
nothing auto-resolves a coordinator's work away.
9 · No vendor is named. The connector is defined by the contract it must meet — OAuth, folder-scoped access, signed
change webhooks — so any provider a firm already uses can be attached without a design change.
Light and dark are both designed here. Every name, amount, address, reference and hash on this page is synthetic demo data.