Trust

Audience reasoning anywhere in Sentinel — campaign targeting, CRM filters, sequence enrollment, AI drafting — uses lease stage, community, source, lease dates, and public economic data only. There are no fields for protected-class attributes, so they can't be filtered on. Every AI prompt that touches people or campaigns carries an explicit constraint block: no inference, commentary, targeting, or steering on race, color, religion, national origin, sex, familial status, disability, or any protected class. Ask the AI for something that conflicts with fair-housing law and it refuses briefly and offers a compliant alternative.

AI drafts; humans send. Sequence emails render fully — subject, body, merge fields resolved — and park in the approval queue where you read the exact message before it goes anywhere. Approval is on by default and recommended always-on. Consent flags (email / SMS) are enforced at the engine level: a person without consent is skipped automatically and the skip is written to their timeline. External intake can never set consent beyond the form's own checkbox, and never sets a stage deeper than Lead.

Every AI output says what it is. Memos: "AI-drafted from your numbers · review before circulating." Ask Sentinel: "drafts from this record + public market data — you decide what's sent." AI-suggested memories are labeled as AI-sourced. Market figures carry their sources (Census · HUD · BLS · FRED) on every surface. Underwriting math is never AI — it's a deterministic engine with golden-master tests, and AI narrative generation only reads numbers the engine produced.

Every consequential action — person created, stage moved, sequence approved, renewal outcome, underwriting locked, settings changed — is recorded with who, what, and when. Admin → Audit Log is the flight recorder.

A hard daily spend cap governs every AI feature. Today's spend is always visible in the rail; at the cap, AI features pause gracefully until tomorrow — deterministic features (pricing data, funnels, renewals, the finance engine) are unaffected. Expensive jobs (AI deal-sourcing) are opt-in per state and individually metered.

Single-tenant by design: your install, your database, your files, your API keys. Locked underwriting versions are immutable. The lead pipeline is loss-proof by ordering — every inbound lead is saved and acknowledged before any downstream forwarding runs. Backups are a file copy of one data directory.