Client review is ScopeBlind’s tool for agencies. You describe the change. Your client tries it, and you both approve that exact version. A small ScopeBlind step in your GitHub repository merges only that version, and you both keep a signed record anyone can check. Agents can help; people decide.
Say what it should do and how you will both check it.Your AI can draft the change; you decide what is asked.
Your client
Try it, then approve
They open one link and try the working preview.You each approve this exact version.
Your GitHub repository
It is merged as approved
A small ScopeBlind step merges only the approved version.Change anything later and it needs a new yes.
Anyone with the record
Check it later
Open the record in any browser, with no account.See who approved what, and what it does not prove.
ScopeBlind controls only the step it installs in your repository: anyone else with access keeps their own permissions. A preview can change after it is recorded, and an AI’s assessment is advice, not an approval.
The demo uses a sandbox repository and a sample website, and sends no real messages. An approval names the exact version it was given to, so a change after approval needs a new decision from both of you; nothing carries over quietly.
Client review plans
Priced on its own, separately from the bill check. Prices exclude taxes and are in US dollars, and team setup starts with an enquiry, not a checkout. Payment and cancelling.
Free
$0forever
Try the demo and check any record, with no account.
The instant demo, and the real demo with someone on a sandbox repository
Check any record in your browser; it is never uploaded
The open-source receiver and verifier, for your own setup
Checking records stays free. Your own deployment and model usage have their own costs.
Team
$200per workflow per month · founding pricing
For recurring client work, such as every change to one client’s website. Fourteen days free, then monthly until you cancel.
Checks enforced and recorded on the workflow’s configured routes
Shareable check links; unlimited agents, approvers and recipients
Email and call support on Sydney business days, best effort
Manual setup · scope agreed before the free days start
A workflow is one standard in force. When the fourteen days end, Team continues monthly unless you cancel by email before then. Founding pricing is held for twelve months from the day your fourteen free days start. Payment and cancelling.
Design partner
$500per month · month to month
The first five teams: Team for one workflow, plus us in the room.
A weekly working session with the founder
A say in what gets built next
A case study you approve before publication
Manual setup · by agreement
Custom integration is scoped and priced separately. Cancel any month by email.
A valid signature shows that the signed fields are unchanged and identifies a key. The record binds the brief, the exact version, the decisions and the outcome together. Whether the brief was right, who holds a key, and whether anyone watched independently still need their own evidence.
What a signed record provesIntegrity, one exact version, and checks anyone can repeat.
Signed, not trusted
Signed records bind their disclosed fields to a key. An edit to a signed field fails verification. Local verification checks the signatures and commitments it supports; it does not turn every displayed status into independently signed evidence.
One exact version
Every approval names the digest of the version it was given to. A changed version has a different digest, so the earlier approvals no longer apply to it and both people decide again.
The preview your client tried
For a generated preview, the record carries the digest of every file your client saw, checked byte by byte before approval was enabled. For an external preview, the record carries what was observed and when; such a page can change later.
Applied as approved
The receiver in your repository applies only the version both approvals name, then records what it read back from GitHub. Your client’s acceptance of the result is a separate signed decision.
Verification runs locally
Opening a record on Verify checks it in your browser without uploading its contents. The open verifier does the same offline, and the recorded run of 17 September is there to try.
What it does not proveWhether the brief was right, who holds a key, and what was never recorded.
That the brief was right
The record proves what was asked, shown and approved, not that it was the right thing to ask. An agent’s assessment of the criteria is advice in the record, never an approval.
Key safety
A signature proves the holder of a private key signed it, not that the key is still in the right hands. If a browser or device is taken over, its key can sign. There is no ScopeBlind recovery backdoor.
A complete history
One record is not proof you have seen everything. Trimming or rewriting an earlier record is detectable to anyone who kept an earlier copy and checks the consistency proofConsistency proof: a check that a later record is consistent with the signed record it extends.; it is not detectable from one record in isolation.
Anything outside the step
ScopeBlind controls only the step it installs in your repository. Anyone else with access keeps their own permissions, and a branch can change by other hands; the record says what the step did, not what everyone did.
The demo uses a sandbox repository and demonstration keys. Your own reviews use the keys your browser creates and the receiver’s own key, which stays in your repository.
Where your data goes
Where each part of a review runs, what ScopeBlind stores, and what a model provider receives.
The hosted review
A client review uses the service
ScopeBlind stores the review’s names, brief, criteria, decisions, results and a copy of the preview your client saw, and runs the sandbox repository the demo uses. Browser signing keys stay in their browsers.
The button demo
Scripted requests; no live model.
A coding job or Resolve this
The brief, criteria, feedback and the source files it works on go to the model provider, only when someone in the review starts one.
Your own agent
Reads the review within the limits both people agreed, and may send what it reads to its own provider.
Use fictional information in the demo. A real client review carries real repository names, file paths, excerpts and feedback.
Your repository and your agent
Your setup defines the boundary
The receiver is a step you install in your own repository. It keeps the repository’s write credential and its own signing key, and applies only a version both people approved. Credential isolation and coverage depend on your agent, hooks and destination setup.
Your agent’s model and tools have their own data paths. ScopeBlind controls only the step it installs; anyone else with access to the repository keeps their own permissions.
The demo does not certify your deployment. Check the installed receiver, its keys and the repository’s branch protection before relying on it.
Verification and sharing
Checking a file runs locally
Files opened in Verify are checked in your browser without uploading their contents. The open verifier does the same offline once it and the files are on your machine.
Sharing a record, a review package or a view-only snapshot discloses what is inside it to whoever receives it: names, public keys, decisions and notes.
A valid signature establishes integrity and the signing key. It does not establish that a brief was right, that anyone observed the work independently, or that every route was covered.
The Privacy page lists each item the service keeps, where, and for how long; the Security page says what runs where. Both name the same companies that process data for the service.
What a shared record disclosesEach form of the record carries different fields; read the one you are sending.
What you share
What it contains
What a check establishes
The signed record
Names, public keys, the brief and criteria, decisions and notes, the receiver’s readback and the acceptance
Intact signatures and the bindings between them; not who holds a key
The review package
The record, the verified preview bytes and an offline viewer in one HTML file
The same checks, with no network and nothing sent anywhere
A view-only snapshot
An exact copy of a result, kept for 30 days under its own link
What the record said then; it cannot change afterwards
Signing keys
Public keys and signatures; private keys never leave their browser or repository
Pin the expected signer through a channel you trust before relying on a record
Key custodyYour browser, the receiver and the service each hold a different key.
Your key stays in your browser
A review creates a non-extractable Ed25519 private key and keeps it in that browser’s storage. Public keys and signed decisions go to the service; an invitation never contains a private key. Clearing site data removes the key from that browser.
The receiver’s key stays in your repository
The step you install keeps its own signing key beside the repository’s write credential. ScopeBlind never holds either.
The service has its own signing authority
ScopeBlind runs the sandbox and signs its observations with a separate service key. A participant signature and a service signature have different roles; the service’s signature does not make it an independent witness.
Key possession is not identity or safe custody
A name in a review is a guest label. Pin the public keys you rely on through a channel you already trust, and treat a device that may be compromised as a key that may be compromised.
Collection boundariesLocal checking, hosted work and explicit sharing are separate actions.
Local verification does not upload the opened file
The browser checks the record locally. Loading the page or fetching a shared record you asked for is separate from sending a file to the service.
Hosted work stores the review
Names, briefs, criteria, decisions, results and the preview copy are service data. A model feature sends its stated context to a model provider only when someone starts it.
Publishing and sharing disclose selected content
A view-only snapshot, a hosted share or a downloaded record shares its actual fields with whoever receives it.
Security and diligence
What runs where, how data is handled, the content security policy, the sub-processors and responsible disclosure are on one page: Security. The Privacy page lists every item kept and for how long. The reference material written for the earlier finance products is kept under Earlier work.
Build integrity and cryptographySource identity, release manifest, and the offline verification path in one place.
This is the provenance record for the hosted ScopeBlind surface. The build manifest binds each generated page to the source commit below. Record verification is separate: it recomputes canonical bytes and verifies the Ed25519 signature locally.
Bind a record to a signing key and make any byte-level edit detectable.
Canonical JSON
Produces one deterministic preimage for the same disclosed fields.
SHA-256 commitments
Bind the exact version, the preview bytes and the brief without publishing them twice.
Open verifier
Runs without a ScopeBlind account or hosted verification dependency.
# inspect the hosted artifact manifest
curl -fsS https://scopeblind.com/build-provenance.json
# verify a shared record offline
npx @veritasacta/verify record.json
A valid signature proves integrity and key possession. Trust still requires you to pin the expected signer, read what the record says it does not prove, and decide whether that is enough for your purpose.
QuestionsThe security questionnaire, a walkthrough for your team, or a design-partner place