Governed pilot
One approval workflow in your NetSuite, governed for 90 days.
An analysis proposes a write. A person other than the proposer on record approves it. Each step lands on a hash-chained ledger whose export you can recompute in your browser.
$15,000, invoiced. The second half is due on written acceptance against agreed criteria. The full fee is credited to a first-year annual contract.
Nervos has no customers yet and has run no pilot. This page says what is true today.
The pilot
One governed workflow, with nothing live before the gate.
One high-frequency approval workflow in your NetSuite. It starts in demo mode, which sends nothing to NetSuite.
It can run against your NetSuite sandbox account once Nervos runs a separate non-production environment. Nervos does not run one yet. Until it does, the sandbox phase runs in demo mode.
A live write waits for a gate that both pilot owners check and sign. Until it passes, Nervos’s production service holds none of your NetSuite credentials.
Out of scope: a second workflow or ERP, custom development, and single sign-on. Sign-in is by an emailed link.
| Topic | Today |
|---|---|
| Customers | None yet. Nervos has run no pilot. |
| NetSuite | The NetSuite connector is implemented and not yet exercised against a live account. |
| Authorization | In our repository, a write is dispatched only under a server-recorded human authorization bound to the proposal (AUTHZ-01). |
| Separation of duties | An approval by the proposer on record is refused. The check rests on who is on record as the proposer (SOD-01). |
| The service we run | Some of the controls on the security page are not yet in the build we run. A live write waits for the gate. |
| Certification | Nervos holds no certification (CERT-01). Its control mappings are not certifications. |
Deliverables
What you hold at the end of the pilot.
You keep the audit trail either way.
- 01
The governed workflow.
Your workflow, run as proposal, approval by a person other than the proposer on record, and dispatch. Each step goes on the ledger.
one workflow - 02
An evidence bundle, with the exported ledger.
A bundle sealed with a SHA-256 content hash, and the exported execution ledger of each write. The export recomputes in your browser at the ledger verifier. A match shows the export is consistent with itself. Keep each export’s last hash to catch a later rewrite.
SHA-256 - 03
Expected against observed, per decision.
For each in-scope decision, what the agreed criteria say it should show, against what it did show. A person reads it from the exports. Every criterion is measurable inside the pilot.
per decision - 04
The audit export.
A structured CSV or JSON export of the governed steps, for your controller, your auditor or a DCAA review.
CSV · JSON
The readout
What the readout can show, and what it cannot.
The readout reads each in-scope decision against the agreed criteria, and says which were met.
The readout gives no calibration verdict. A verdict needs at least 20 resolved yes-or-no predictions. An analysis registers none of those, because its forecast is a range of outcomes.
- 01
At most one forecast per analysis.
Registered predictions are off by default. Where they are on, an analysis registers at most one forecast. It resolves 90 days after the analysis runs, the same length as the pilot.
- 02
Only a kickoff-date forecast resolves in time.
So only a forecast registered on the kickoff date can resolve inside the pilot. It resolves on the pilot’s last day, at the hour its analysis ran. It is shown only if the readout comes after that hour, and a person has confirmed it is on record.
- 03
Every later forecast stays open.
Every later forecast is handed over open, with its resolution date. None is resolved early to fit the readout.
Qualification
What a pilot needs before kickoff.
Each is in place before kickoff. Without one of them, the pilot cannot run or cannot be measured.
- 01
One ERP workflow.
One high-frequency approval workflow in NetSuite. The default is a vendor bill tied to a purchase order.
NetSuite - 02
At least two named approvers.
Two named people who approve writes. Neither approves a write they proposed. In our repository, policy can require a second, distinct approver for a write (AUTHZ-03).
two or more - 03
A NetSuite administrator on your side.
Someone who creates an integration role and uploads the Nervos RESTlet in your sandbox account. Nervos does not ask for administrator access to your account.
integration role - 04
A data-boundary sign-off.
Your security or data owner agrees in writing what data the workflow touches, and which providers receive it.
in writing
Data boundaries
What data the pilot touches, and where it goes.
Your data-boundary sign-off is made against these facts, as they stand today.
- Classification
- Internal to your organization, by default
- Set for the whole deployment. Classification of individual records is not yet available. Not for CUI, export-controlled data or regulated personal data.
- Where it lives
- One shared, multi-tenant service, with its database on AWS us-west-2
- No dedicated or regional deployment is available today.
- Sub-processors
- Published register
- The providers that process customer data, with each one’s region and the data it receives.
- Retention
- Set in the data processing addendum signed with the pilot
- The published deletion terms are under review. The addendum sets them for the pilot, including how a deletion request applies to the ledger.
- Analytics
- PostHog on the public site only, Vercel Web Analytics and Speed Insights on every page
- PostHog records nothing on signed-in pages, including after you move to them from the public site. Session recording is turned off in our code. Vercel Web Analytics and Speed Insights load on every page, signed-in pages included, and report page views and page-load performance. Each provider is on the sub-processor register.
Plan
Thirteen weeks, from kickoff to readout.
Week 1 starts on the kickoff date. The last day is the kickoff date plus 90 days, the last day of week 13.
| Week | What happens | Owner |
|---|---|---|
| Before kickoff | The workflow is chosen. Success criteria are agreed in writing. The annual price is named. The statement of work is signed and the first invoice sent. | Nervos and you |
| 1 | Your organization is set up in Nervos. Your administrator creates the integration role and uploads the RESTlet to your sandbox account. A read-only round trip is checked from a separate non-production Nervos environment, once one exists. If registered predictions are on, the kickoff analysis runs on the kickoff date. | Your administrator and Nervos |
| 2 | A dry run of the full loop, in demo mode, or in the sandbox once that environment exists. Approvers and roles are configured. The baseline is captured from your prior 90 days. | Both |
| 3 | The first live governed write on your workflow, once the gate has passed. The ledger is verified with you. Until then, nothing is written to your NetSuite production account. | Nervos, with you |
| 4–11 | The governed run. Each week, that week’s audit export is recomputed against the last hash kept the week before. One deliberate rollback drill by week 6. It runs on a live write only if your controller has agreed in writing. Otherwise it runs on a demo write, or a sandbox write once that environment exists. In NetSuite, a rollback deletes the record Nervos created. It does not post a reversing entry. | You |
| 12 | Measurement against the baseline. Expected against observed, per decision, on the agreed criteria. The evidence bundle and the audit export are walked through with your controller. | Nervos |
| 13 | Readout: each criterion met or not met. Every open forecast is listed with its resolution date. No calibration verdict. Written acceptance releases the second invoice. | Nervos and you |
Terms
What it costs, how it is paid, and what it is judged against.
Target, agreed in writing, not a result: approval cycle time down by half on the in-scope workflow.
Cycle time is measured per decision, from proposal to approval, against your own prior 90 days. Nervos has run no pilot, so no result exists yet.
- Price
- $15,000
- Invoiced, not charged by card.
- Length
- 90 days
- Thirteen weeks, from the kickoff date.
- One workflow in your NetSuite
- Criteria agreed in writing before kickoff
- $7,500 at kickoff, $7,500 on written acceptance against the criteria
- Credited in full to a first-year annual contract
After the pilot
If it works, the fee becomes the first payment.
The full $15,000 is credited to a first-year annual contract signed within 30 days of the readout.
The annual contract lands on the Operate plan. Its price is named before kickoff, so the readout is a decision about whether it worked.
Next step
Request the pilot, or see the governed loop first.
A person replies within one business day. The private demo walks through one decision, from proposal to ledger.