Amend Evidence Certificate

Status Summary

Obligation Matrix

Clause	Quote	Obligation	Code Sites	Tests (base/head)	Status
314.4(c)(3)	Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest	SG-3	app/logging_mw.py:14 graph jobs/export_underwriting.py:27 graph sql/views.sql:1 graph app/models.py:24 inferred	base:✗ head:✓ [D] base:✗ head:✓ [D]	Partially verified
314.4(c)(5)	Implement multi-factor authentication for any individual accessing any information system	SG-5	app/support_legacy.py:12 graph app/main.py:61 graph app/auth_routes.py:54 graph app/auth_routes.py:63 graph	base:✗ head:✓ [D] base:✗ head:✓ [D] base:✗ head:✓ [D]	Verified
314.4(c)(7)	Adopt procedures for change management	SG-7	—	—	Human review required
314.4(j)(1)	you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event	SG-9	app/incidents.py:13 inferred	base:✗ head:✓ [D]	Verified

Guard Findings

None

Canary Hits — Before

Store	Path	Offset	Snippet
sqlite	var/lendwise.db	147924	Y000-**-****000000417 · pending2
sqlite	var/lendwise.db	147993	.012655B · Y000-**-****000000417 · pending2
sqlite	var/lendwise.db	147935	Y000-00-0417000*** · pending2026-09-26
sqlite	var/lendwise.db	148004	Y000-00-0417000*** · pending2026-09-26
log	var/log/app.log	2	2026-09-27 00:47:00,008 DEBUG lendwise.http incoming request method=POST path=/a
log	var/log/app.log	2	2026-09-27 00:47:00,008 DEBUG lendwise.http incoming request method=POST path=/a
bucket	var/buckets/analytics/uw_export_2026-09-27.csv	369	368,41700.0,pending,000-**-****
bucket	var/buckets/analytics/uw_export_2026-09-27.csv	370	369,41700.0,pending,000-**-****

Canary Hits — After

Store	Path	Offset	Snippet
sqlite	var/lendwise.db	160212	Y000-**-****000000417 · pending2
sqlite	var/lendwise.db	160281	.964602B · Y000-**-****000000417 · pending2
sqlite	var/lendwise.db	160223	Y000-00-0417000*** · pending2026-09-26
sqlite	var/lendwise.db	160292	Y000-00-0417000*** · pending2026-09-26

Test Integrity

No unapproved changes to pre-existing tests.

Pre-existing tests rewritten by a named human because they asserted behaviour the obligation prohibits (agents are blocked from editing them):

Test file	Reason	Approved by
tests/test_auth.py	test_staff_login_success and test_mobile_token_success expected a session without a second factor (314.4(c)(5)); they now send the one-time code	compliance-lead
tests/test_export.py	test_export_csv_contents asserted that the analytics export carries the plaintext SSN as "tin" (314.4(c)(3)); it now asserts the SSN is absent	compliance-lead
tests/test_servicing.py	test_legacy_impersonate_with_valid_key reached a full customer profile with the staff API key alone (314.4(c)(5)); it now also presents an MFA session	compliance-lead

Artifact Hashes (SHA-256)

File	SHA-256
matrix.json	9062138b6a834480e11ad5a941e1d613e770745b1ad440df9b487678a7d59a8e
certificate.json	dcbe7ba43fac54a6205036b8b8865104fa58f181ee2dba6b91e0b8d5f53ec090
certificate.md	ce07b05b18881d9bc3292ad728c3926d34f7ed3e4f37447e0fd304023cb9d800