Financial site
The rules · 17 August 2026

Read it before you talk to us.

Every rule DuckWater holds itself to, and — the part that matters — what is actually holding it up. A test that must pass before code ships, a clause in an agreement, or a decision people keep. Written to be argued with.

How to read this

Three labels, and they are not equal

A trust page is easy to write and impossible to check. So each line below carries the thing that would break if we stopped meaning it.

  • TestA test that must pass before the code ships, named with its file. Run npm run test:convex and npm run test:node and you have checked it yourself. Nothing is labelled this way until the test is green.
  • ContractA clause in the partner agreement. Drafted. No institution has signed one, so no clause on this page is in force with a counterparty today.
  • PolicyA decision people keep. Nothing stops it changing except this page having said it, and the date on it.

A red test stops the sentence, not the company — but it does stop us shipping that sentence. If you find a rule here that the software does not keep, tell us and the rule or the code changes, in public, with the date.

The router

What decides which institution sees a file. It reads facts about institutions — state, product, amount band, collateral type, field of membership, capacity — and nothing about the person. Credit, income, coverage, date of birth and SSN are not fields it can read, because they are not in what it is given.

  • TestRouting picks who reviews a file. It never decides the answer.convex/options.ts holds no branch on income, credit or budget; convex/bridge.test.ts — “the state gate fails closed — unknown state and unserved state both yield nothing”
  • TestAn institution that does not name your state is not offered one. Silence is not coverage.convex/bridge.test.ts — “state codes are validated, not merely stored”, and the gate test above
  • TestA product switched off shows nothing, even where an institution serves it.convex/bridge.test.ts — “an inactive product shows nothing even where an institution serves it”
  • TestA paused institution cannot receive a file, even from a page that was already open.convex/bridge.test.ts — “a paused institution cannot receive a hand-off, even from a stale page”

Neutrality

No placement is sold, nothing is featured or preferred, and the contractor is never charged. The ordering key is objective and published; the customer sees the same list whoever is on it.

  • TestOptions are ordered by an objective key — state, product, amount, then A to Z. Never by any commercial consideration.convex/bridge.test.ts — “options are ordered by an objective key, never by what a partner pays”
  • PolicyThe contractor is never charged. Zero dealer fee, permanently — not a launch offer.Owner decision, 17 August 2026. There is no contractor billing surface to switch on.

A regulator's question is not “which version did they accept”, it is “what did they see”. A version number cannot answer that once the text behind it has been edited, so the text itself is stored.

  • TestA file cannot be handed to an institution without a live, matching consent.convex/bridge.test.ts — “a hand-off is impossible without a live, matching consent”
  • TestThe disclosure is stored verbatim, as shown, with the time it was granted. Revoking keeps the record.convex/bridge.test.ts — “consent stores the disclosure verbatim, and revoking keeps the record”
  • TestThe introduction is recorded before the person is sent anywhere, so an introduction we cannot account for cannot happen.convex/bridge.test.ts — “the referral row exists before a destination is handed back”

Licence and insurance

A contractor's licence and certificate of insurance are what make a file underwritable, so they are required documents with expiry dates rather than a checkbox. What follows is exactly how much of that gate is switched on today — which is less than the marketing of any competitor would imply, and is the point of saying it here.

  • PolicyA licence and a certificate of insurance are required of every Builder Partner, and both carry an expiry date that a daily job watches.Seeded as required-and-expiring in convex/documents.ts, and a daily job flips a lapsed one to expired. Today that makes it a checklist rather than a bar — see the next line for exactly where the bar is.
  • TestAn expired document is visible and raises the partner. It does not block invitations — until an administrator sets a grace period, and then it does.convex/documents.test.ts — “expiry is visible but does not block, until a grace period says it does”. The blocking gate is off by default and this page will say when that changes.
  • TestWith the gate on, a partner with no documents cannot send invitations, and the checklist names the one document holding it up.convex/documents.test.ts — “with the gate on, a partner with no documents cannot send invitations”, “the checklist says which document is the one holding things up”
  • TestAn upload awaiting review does not hold a partner hostage; a rejected one blocks again, because those are different conversations.convex/documents.test.ts — “an upload awaiting review does not hold the partner hostage”, “a rejected document blocks again — it is a different conversation”
  • TestReviewing a document is not open to every member of staff.convex/documents.test.ts — “reviewing is not open to every member of staff”
  • PolicyDuckWater does not sell, solicit or negotiate insurance and cannot bind coverage. A certificate is required; obtaining one is between the contractor and a licensed agency.DuckWater holds no insurance licence. Nothing in the product quotes, binds or endorses.

Money, and what we are told about it

DuckWater holds no funds and no keys. The only money in the system is a number an institution reported after the fact, and it is treated as a report rather than as knowledge. Every status change carries where it came from — a webhook, a poll, or an administrator entering what an institution said. There is no fourth value meaning “we assumed”.

  • TestAn amount only appears on a terminal status, and only as integer cents.convex/bridge.test.ts — “money only appears on a terminal status, and only as integer cents”
  • TestA repeated webhook does not double-count or re-stamp what already happened.convex/bridge.test.ts — “a repeated funding webhook does not double-count or re-stamp”
  • PolicyA status the institution never sent cannot appear: the source vocabulary has four values and none of them means inference.convex/bridgeSchema.ts — the validator admits webhook, poll, admin and system, and Convex rejects anything else at write time.
  • TestEvery entry point into the bridge refuses a caller without the server secret.convex/bridge.test.ts — “every bridge entry point refuses a caller without the server secret”

Who did what

Approvals, status moves, document verification, role changes and exports are written down with who did them. A refused attempt is written down too — the absence of a record is not evidence that nothing was tried.

  • TestA signed-in actor cannot write an event as somebody else, and an unattributed action is recorded as the server, never left blank.convex/events.test.ts — “a signed-in actor cannot write an event as somebody else”, “with no identity the event is attributed to the server, never left blank”
  • TestA refused attempt is recorded, and is visible as refused.convex/events.test.ts — “a refused attempt is recorded, and is visible as refused”
  • TestA contractor sees that a file moved. Never what is in it.The partner-facing projection carries no financial field; tests/email-templates.test.ts — “the partner-facing application notice carries no financial detail”
  • TestA caller cannot grant itself a role, and an empty allowlist is nobody rather than everybody.convex/roles.test.ts — “a caller cannot grant itself a role”, “an empty allowlist is still nobody, not everybody”

What we never do

These have no test because there is nothing to test: the capability is absent. They are here so that the absence is on the record, dated, and can be held against us.

  • PolicyLend, or take any part in a credit decision.No lending licence, no underwriting code, no decision surface.
  • PolicyRun a credit inquiry of any kind — including the “soft pull” a competitor would call harmless.No bureau integration exists. The word does not appear in the product, and the invitation email does not promise it.
  • PolicyHold funds, custody assets, or hold keys.No wallet, no ledger, no disbursement path. Money never touches DuckWater.
  • PolicyScore, rank, grade or “vet” a contractor.Facts and pass/fail against each institution's own written minimums. There is no score column.
  • PolicySell, rent or syndicate a list. DuckWater sells a Project File to the party the applicant consented to, and nothing else to anyone.No data-sale contract exists and none will be signed.
  • PolicyUse the word “anonymous”. An application is private until you choose a lender; that lender then verifies identity, as federal law requires.Copy rule, enforced in review today and by the copy lint when it lands.