Audit-grade by default.
Procurement-ready by design.
Every case signed. Every write-back logged. Every number traceable to the SQL, the model card, and the named approver. The loop survives your security review because it was built for it.
Every case is signed.
Every write-back is attributable.
Audit-ready by construction. Every step on every case carries a signature: the detection that opened it, the cause attribution that named the root, the play that fired, the system-of-record write-back that landed, and the human who approved it. The audit log streams to your SIEM in JSONL the moment events occur. Reproduce any conclusion in one click.
The short list, on the table.
Before you sign.
Pick the boundary that survives
your security review.
Fastest path to first case. Region-scoped, customer-managed keys, full audit stream to your SIEM.
- Time to first case · 48 hours
- Data residency · US / EU / JP
- Tenant isolation · Cedar-enforced
Single-tenant in your AWS or Azure account. Your network, your IAM, your CMK. We deploy via PrivateLink and Terraform.
- Time to first case · 2 weeks
- Network · PrivateLink, no public ingress
- Identity · your IAM, your role assumption
For F500 deployments where data cannot leave the perimeter. Connector runs in your DC; control plane never sees raw data.
- Time to first case · 4–8 weeks
- Data egress · forecasts and metadata only
- Compatible with air-gapped tiers
Tiered, on the page,
before procurement asks.
The directory tells you which connectors are native (we own the contract), which are write-back (we mutate state with a named approver), and which are read-only (we read but never write). No surprises in week six.
Pre-agreed metrics.
Pre-agreed plays.
Pre-agreed close criteria.
No "value" debate at month four. The pilot is structured around three plays you pick from the catalog, the KPIs they're supposed to move, and the threshold each KPI has to clear for the pilot to count as a win.
Read-only connections to your POS, WMS, ERP. Per-store baselines fit. First detect-stage signals on the page.
Plays open cases; recommendations land in the audit log; no write-backs yet. You compare to what your team would have done.
First two plays go live with approver gating. Cases close against the SOR. KPI deltas accumulate against the baseline.
Outcome readout against pre-agreed thresholds. If KPIs cleared, you sign the MSA. If not, we walk.
On the table before you sign.
Your security review starts here.
Architecture, MSA, DPA, SOC 2 letter, COI. On the table before you sign.
Find out what your data has been hiding.
Tell us about your operation. We’ll show you the problems Ward catches — and the ones your current tools miss.