Governance

How this product is allowed to know what it knows.

A demand-intelligence product is a claim about other people's information. This page is the whole claim, in one place, in plain language: where each kind of data comes from, what permission it sits on, what we will never do with it, and — for each commitment — the mechanism that stops us breaking it when it would be convenient.

version 1.0last reviewed 2026-08-15changes are versioned, never silentpermanent URL

A named operation, run by a company you can look up.

This product is operated by CDMO Hub, the company that runs the marketplace at cdmohub.ai. It is not an anonymous data service, and there is no shell between the product and the people accountable for it.

You can see who we are, where we are registered, what else we operate, and how to reach a human who can answer a question about your own data. Every commitment below is made by that company, on this page, with a version number and a review date — so a change is something you can point at rather than something you have to notice.

We operate a two-sided marketplace as well as this product. That is a real conflict shape, so we state it plainly and constrain it in commitment 04: participation in the marketplace does not buy a place in anyone’s edition, and being in an edition is not a product we sell to the company being written about.

What makes it checkable

The operating entity, the governance contact and this page’s version are published here and in /llms.txt. Prior versions of this page stay reachable at their own URLs.

Every kind of data has a stated basis, and we name it per class.

Three classes of information go into a dossier. They sit on three different permissions, and we do not blur them together into one reassuring sentence.

Class	What it is	The basis it sits on
Public records	Regulatory and financial filings published by their issuers.	Published by their issuers for public use. We cite the publisher, the date and the record locator on every fact, and we link to the record so you read it at the source rather than taking our word for it.
Marketplace activity	Requests for information, matchmaking queries and shortlists created by participants on the CDMO Hub marketplace.	The participant’s own agreement with the marketplace. Used only in aggregate, subject to the floor in commitment 03. A buyer organisation is identified to a supplier only where that buyer has chosen to identify itself — through an enquiry it sent on purpose, never through observed behaviour.
Contact records	The named person and coordinates on a dossier: role, business email, business phone.	Licensed from a contact provider or verified by hand for that dossier. Each record shows the date it was verified and its consent status. Records marked permission-first are labelled as such on the dossier so you know before you write. We do not build our own contact database.

What we do not use, at all:

Identifying a company by resolving the IP address of a website visitor.
Device fingerprinting, or any attempt to re-identify an anonymous visitor.
Tracking pixels or tags placed on other people’s websites.
Purchased clickstream or browsing-behaviour data.
Personal profiles scraped from social or professional networks.
Any personal data of a private individual acting outside a business role.

What makes it checkable

Every fact in every dossier renders a provenance chip — publisher, retrieval date, record locator — and the locator resolves to the source. A fact without provenance cannot be composed into a dossier; the composer rejects it.

Buyers appear only in aggregate, above a stated floor.

Nothing a buyer does on the marketplace ever surfaces to a supplier as an identity. It surfaces as a count over a cohort, or it does not surface at all.

When marketplace activity corroborates a signal, a dossier may say something like “in the last 14 days, three enquiries in your capability band referenced second-source qualification.” It will never say who. There is no drill-down, no “unlock”, no upgrade tier that reveals the name, and no version of the export that contains one.

Aggregation happens before the data leaves the marketplace. The interface between the marketplace and this product returns counts and buckets; it has no field in which an identifier could travel, so a mistake downstream cannot leak one.

≥ 3

distinct buyer organisations required before any aggregate is shown

buyer identifiers ever serialised into a dossier

tighten only

configuration can raise the floor and can never lower it

Below the floor, the panel is omitted — not softened. A cohort of one or two does not render as “a buyer”, as “several”, or as a blurred count. The whole panel disappears, and the dossier is published without it. An absent panel is the correct output of a working privacy rule.

What makes it checkable

The floor is a clamped constant: configuration is read, then raised to the floor if it is lower. Aggregation runs on the marketplace side of the boundary and the response carries counts only. Both behaviours are covered by tests that fail the build if an identifier appears in a dossier payload.

Ranking is not for sale, and neither is being in someone's edition.

The only inputs to whether a dossier reaches you are the record and your capability profile. Money is not one of them.

No paid placement. No sponsored dossiers. No fee to be matched, to rank higher, or to appear more often. No per-connection or per-lead charge on anything in an edition — the subscription is the whole commercial relationship, which is exactly why the price is published rather than negotiated.

And in the other direction: a company written about in a dossier cannot pay to have it removed, softened or delayed. Corrections are made because a fact is wrong, evidenced against the record, and they are published as a revision with the prior version still reachable.

If we ever introduce a revenue line that could touch any of this, it will be described on this page before it exists, not after someone finds it.

What makes it checkable

Rank is rendered with its inputs attached — match 2/2 · 1 independent · trigger 41d ago — instead of a single composite number. There is no field in the ranking model that a commercial arrangement could write to, and no dossier state that a payment can set.

Provenance on every fact, and a wall between fact and opinion.

You should never have to guess which sentences came from a regulator and which came from us.

Facts are quarantined. Source-backed records live in their own box, in a monospaced voice, each with its publisher, date and locator. Our reading lives in a separate box, marked as analysis, with its confidence stated. The two never share a container, and analysis references the specific evidence it rests on.

The evidence ledger has to reconcile. Records reviewed must equal supporting plus weakening plus context-only plus identity-only plus unaddressed. A dossier whose accounting does not balance is not published. This is what prevents the quiet disappearance of the record that argues the other way.

Counterevidence is always rendered. Where nothing was found, the panel says it was checked and nothing was found — an empty result you can see, not an empty space you have to interpret.

Coverage distinguishes different kinds of nothing. Checked and nothing matched, matched but every result withheld, not checked this cycle, and source unavailable are separate statuses, and an unavailable source is named along with the reason. A source we could not reach never renders as a source that came back clean.

Corrections are revisions. A corrected dossier increments its revision, states what changed and when, and leaves the earlier revision reachable. We do not edit history in place.

What makes it checkable

These are composition invariants, not editorial habits: the publish gate rejects a dossier with an unreconciled ledger, an un-sourced fact, a missing counterevidence result or a coverage row without a status. Every one of them is visible on the public sample dossier, including the degraded sources on that run.

Where we do not know, the product says so.

The failure mode of an intelligence product is confident filler. Every place we might be tempted to fill a gap, the design makes the gap speak instead.

No verified contact renders, verbatim, as “No verified contact yet for this organisation. We only show people we have actually verified. We do not guess email addresses.” — never as a pattern-matched address that happens to be right most of the time. Every dossier in the current edition renders that state, because verified contacts are not shipped yet.

The successor qualifier is never a yes or a no. It carries a classification, the number of filings actually reviewed, the number of named manufacturers found, a confidence, and a required caveat.

An empty week sends nothing. If no dossier clears the bar for your profile, there is no email, no digest of near-misses and no filler. Silence is a result, and padding an edition to look busy would corrupt the only metric that matters — whether the thing we sent was worth reading.

Sample and fixture data is labelled as such wherever it appears in the product, so no one mistakes a demonstration for an observation.

What makes it checkable

Absence states are components with their own rendering, not empty strings: the honest-absence contact block, the qualifier with its counts and caveat, the zero-week edition that renders the full coverage table in place of dossiers.

Removal, exclusion and retention.

What we can remove, what we cannot, and how long anything is kept.

If you ask us to…	What happens
Remove a contact record about you	We suppress it. A suppressed record is never rendered again on any dossier, in any edition, for any subscriber, and the suppression persists through re-licensing from a provider — the record cannot silently return.
Stop sourcing contacts at your organisation	We add the organisation to the contact-sourcing exclusion list. Dossiers about the organisation can still exist from public records, but they render the honest-absence contact block instead of a person.
Correct a fact about your company	Send us the record. If the record supports the correction, the dossier is revised, the revision states what changed, and the prior revision stays reachable. We correct against evidence, and we do not remove a correctly-cited public record because it is unflattering.
Remove a public regulatory record	We cannot, and would not claim to. A recall, a filing or an inspection classification is published by its issuer, and our copy is a citation. The right place to challenge the record is with the body that issued it.
Know how long things are kept	Public records are retained for as long as the citation is useful and are re-checked against the source. Contact records carry a verification date and are re-verified or dropped rather than allowed to age silently. Marketplace-derived aggregates are counts, hold no identifiers, and are recomputed per edition rather than accumulated.

Response commitment

A request to the governance address gets a human reply. Suppression of a contact record is applied on receipt, before any assessment of the rest of the request.

07 · Verification

How to check these claims without taking our word for it.

Each commitment above has something you can look at. Most of them are visible on the public sample, which is why the sample is a real dossier rather than an illustration.

“Facts and analysis never blur.”

On the sample, read the analysis panel and the facts panel. Every sentence in the facts panel has a publisher and a retrieval date attached; the analysis sits in its own labelled container and cites the evidence it rests on.

“The ledger reconciles.”

The accounting line under the facts adds up in front of you: 4 reviewed = 1 supporting + 0 weakening + 3 context-only + 0 identity-only + 0 unaddressed. If it did not add up, the dossier would not exist.

“Coverage names its own gaps.”

The sample’s coverage table lists every source on the list with its status — including three source_unavailable rows with the reason written out, one not_checked which is never counted as a clean result, and one matched_all_withheld where every result was withheld and the count and reason are shown. It also discloses, on the source that did match, how many records could not be assessed and why. A product hiding its gaps would have shown clean rows.

“Buyers appear only in aggregate.”

The sample has no marketplace-corroboration panel at all. That is the floor working: the cohort behind it did not reach three distinct organisations, so the panel was omitted rather than degraded.

“Nothing sends from here.”

Search any page of the product for a send button or a mailto: link on a contact. There are none, on any surface, by design — the opener is a copy target.

“Ranking is not for sale.”

Every dossier shows the inputs that produced its position instead of a composite score, so a position you disagree with can be argued with on a specific input.

09 · Who to write to

One address, read by a person.

Questions about any commitment on this page, a correction to a fact, a contact-record suppression or an organisation-level exclusion all go to the same place. It is not a ticketing loop and it is not an unattended alias.

governance@cdmohub.ai

See the claims on a real dossier

How this product is allowed to know what it knows.

version 1.0last reviewed 2026-08-15changes are versioned, never silentpermanent URL

Class

What it is

The basis it sits on

Public records

Regulatory and financial filings published by their issuers.

Published by their issuers for public use. We cite the publisher, the date and the record locator on every fact, and we link to the record so you read it at the source rather than taking our word for it.

Marketplace activity

Requests for information, matchmaking queries and shortlists created by participants on the CDMO Hub marketplace.

The participant’s own agreement with the marketplace. Used only in aggregate, subject to the floor in commitment 03. A buyer organisation is identified to a supplier only where that buyer has chosen to identify itself — through an enquiry it sent on purpose, never through observed behaviour.

Contact records

The named person and coordinates on a dossier: role, business email, business phone.

Licensed from a contact provider or verified by hand for that dossier. Each record shows the date it was verified and its consent status. Records marked permission-first are labelled as such on the dossier so you know before you write. We do not build our own contact database.

Provenance on every fact, and a wall between fact and opinion.

You should never have to guess which sentences came from a regulator and which came from us.

Counterevidence is always rendered. Where nothing was found, the panel says it was checked and nothing was found — an empty result you can see, not an empty space you have to interpret.

Corrections are revisions. A corrected dossier increments its revision, states what changed and when, and leaves the earlier revision reachable. We do not edit history in place.

What makes it checkable

If you ask us to…

What happens

Remove a contact record about you

We suppress it. A suppressed record is never rendered again on any dossier, in any edition, for any subscriber, and the suppression persists through re-licensing from a provider — the record cannot silently return.

Stop sourcing contacts at your organisation

We add the organisation to the contact-sourcing exclusion list. Dossiers about the organisation can still exist from public records, but they render the honest-absence contact block instead of a person.

Correct a fact about your company

Send us the record. If the record supports the correction, the dossier is revised, the revision states what changed, and the prior revision stays reachable. We correct against evidence, and we do not remove a correctly-cited public record because it is unflattering.

Remove a public regulatory record

We cannot, and would not claim to. A recall, a filing or an inspection classification is published by its issuer, and our copy is a citation. The right place to challenge the record is with the body that issued it.

Know how long things are kept

Public records are retained for as long as the citation is useful and are re-checked against the source. Contact records carry a verification date and are re-verified or dropped rather than allowed to age silently. Marketplace-derived aggregates are counts, hold no identifiers, and are recomputed per edition rather than accumulated.

How to check these claims without taking our word for it.

Each commitment above has something you can look at. Most of them are visible on the public sample, which is why the sample is a real dossier rather than an illustration.

“Facts and analysis never blur.”

“The ledger reconciles.”

“Coverage names its own gaps.”

“Buyers appear only in aggregate.”

The sample has no marketplace-corroboration panel at all. That is the floor working: the cohort behind it did not reach three distinct organisations, so the panel was omitted rather than degraded.

“Nothing sends from here.”

Search any page of the product for a send button or a mailto: link on a contact. There are none, on any surface, by design — the opener is a copy target.

“Ranking is not for sale.”

Every dossier shows the inputs that produced its position instead of a composite score, so a position you disagree with can be argued with on a specific input.