Report 001 · run 12 July 2026 · chain re-verified 29 July 2026

Governance Report 001

Almost every vendor in this category publishes benchmark numbers. This is a report from a real operating company's live ERP — a 36-year-old furniture business with an actual customer table — including the places where the report is weaker than it looks.

121,374
records processed
121,366
identities masked
485,496
fields masked
0
leaked to the model

What was measured

On 12 July 2026 at 10:58 UTC, the full customer table of our own family company's production ERP was read (read-only) and passed through Conarium's real Governance.redact() path. Raw personal data was never written to disk at any point. The run produced 123 audit lines: 121 batches of 1,000 records, one final batch of 374, and one summary line.

The arithmetic is checkable from the audit file alone: 121 × 1,000 + 374 = 121,374 records, and 121 × 4,000 + 1,496 = 485,496 masked fields. Those two independent sums matching the summary line is the first thing you should verify, because it is the cheapest way to catch a fabricated report.

121,374 records produced 121,366 identities. The 8-record gap is records that yielded no identity token. We have not yet traced why for each one — most likely rows with no name populated. We are stating the gap rather than rounding it away; if you want the precise cause, ask and we will go find it.

Chain integrity, re-verified 17 days later

The audit log is hash-chained: each line carries the hash of the previous one, and the first line starts from 64 zeros. On 29 July 2026 — 17 days after the run — the chain checker that ships in the repository was run against the same file:

$ node scripts/audit-chain-check.mjs audit-cariler.jsonl

exists: true · bytes: 46667 · lines: 123
prevHash breaks: 0
self-hash mismatches (tamper suspicion): 0
ok: true
$ echo $?
0

Zero breaks, zero mismatches. No line was edited, deleted or reordered between 12 and 29 July.

What this does not prove

The chain proves the log was not altered after the fact. It does not prove the masking was correct at the moment it happened, and it does not prove nobody bypassed Conarium and read the table directly. Those are different guarantees and we are not going to blur them. The signature on this log is HMAC, which is symmetric — so today this is internal consistency, not third-party non-repudiation. Asymmetric signing is being built now; when it lands, a third party will be able to verify this without trusting us at all.

The measurement error we made on the first attempt

The first run of this measurement reported 1 leaked value. It was wrong, and the way it was wrong is worth publishing.

The leak detector was searching for each raw value anywhere in the row's JSON. A short fragment of a phone number happened to appear inside an unrelated internal numeric ID, so the check fired. It was reproduced locally with a synthetic case, the detector was rewritten to compare field by field, exact match, and the run was repeated clean.

The masking engine had made no mistake at any point. The measuring instrument was broken, not the product. We are publishing this because a governance report that has never reported a problem with itself is not a report, it is an advertisement.

What we redacted from this report, and why

The audit summary line contains a source field naming our internal ERP database and table. We have redacted it here to codes:<internal-erp>.<customers-table>.

It is our own schema, not a customer's, so the risk is low — but publishing your own internal object names in a public document is exactly the habit our product exists to break. We caught the same class of leak in our public demo on 17 July, where a table description still read "ZION mirror (Codes sync)" and exposed an internal system name to demo visitors. It was fixed with a regression test. Applying the rule to ourselves in this report costs nothing and the alternative would be embarrassing.

Honest limitations of this report

Reproduce it

The engine that produced these numbers is MIT licensed and public. You cannot run it against our ERP, but you can run it against yours:

git clone https://github.com/dogrucanemek-alt/conarium.git
cd conarium && npm install && npm run build

# Masking + audit chain, no database required
npx tsx demo.ts

# Verify any audit file, including your own
node scripts/audit-chain-check.mjs path/to/audit.jsonl

Or attach the public demo endpoint to your own Claude and watch the masking happen in your own tool: conarium.dev/#trylive.


Found an error in this report — including one that flatters us? → e.dogru@conarium.dev. Corrections get published with the correction noted.
Report 001 · run 2026-07-12 · chain re-verified 2026-07-29 · Comparison · Technical overview · Source (MIT)
© 2026 Conarium · Self-hosted. Fail-closed. Governed by you.