Methodology & trust
PackClose connects each total to its source, calculation, owner, and exact workpaper version. That gives finance repeatable math, gives compliance a faster validation response, and gives the next owner a clean handoff.
Every value in the workpaper - a component weight, a units figure, a state/material kilogram - travels the same five-stage chain. A number that has not completed the chain is visibly an estimate or a gap; it cannot silently become part of the record.
Why immutability matters: a validation request asks how a number was built at the time you reported it. A workpaper that can quietly rewrite itself cannot answer that question - a correction chain can.
This is the same boundary stated on the overview page, verbatim, because it does not change with the audience: producer status, exemptions, and submission are decisions and actions that belong to you, your reviewer, and your counsel. We record those decisions; we never make them.
No customer data enters consumer AI tools. If any model-assisted processing is used, it happens only under commercial no-training terms - or not at all, at your election, recorded in the workspace or optional-service terms.
Before any customer document enters the workspace, a binding checklist applies: accepted workspace terms and data authorization, an approved commercial no-training AI path (or none), an isolated workspace, MFA, least-privilege access, encryption, access and audit records, active-content screening before storage, and backup/recovery. Optional services add their own agreement, authorization, and recorded internal-QA scope.
The QA-checked workpaper, substantiation pack, source inventory (with hashes), and full version history are retained under the workspace's configured schedule or the optional engagement's agreed retention period - and everything is exportable to you on demand.
When an account or engagement ends, data remains exportable for the stated availability window and is deleted under the applicable retention/deletion procedure. One honest caveat: an active retention obligation or legal hold blocks deletion until it lapses - and that block is itself recorded, not silent.
Software surfaces problems; it never decides them. Every material decision passes through an attributed person whose role and reasoning are on the record. In the self-serve workspace, that person is on your team; an optional service names its engagement lead without implying a professional reviewer who has not been contracted.
| Element | How it works |
|---|---|
| Who checks the work | Self-serve records are reviewed and approved by the people you authorize. Scan and close workpapers are additionally checked against our documented internal QA checklist by the engagement lead before delivery. No qualified reviewer is presumed; qualified professional review is not bundled into the workspace or initial scan. |
| Recorded decisions | Who decided, what they decided, the basis, and the date - captured for every resolution, approval, and correction, in an append-only audit log. |
| Separation of events | When internal service QA is present, it and your data approval are separate recorded events on the workpaper version - separate actors and timestamps, never merged. |
| Blocking checks | A field with no source document, or with unresolved divergence between sources, cannot be approved. The queue stays visible until an authorized person resolves it with an attributed rationale; nothing is waved through. |
| Your decisions stay yours | Producer status, exemptions, and what to submit are decisions you make with your reviewer or counsel. We record the decision, its basis, and its date - we never compute it. |
What is shipped and continuously tested today, what is planned, and the language we refuse to inflate. Ask for the procurement pack to get all of it in writing.
| Control | Status |
|---|---|
| Workspace isolation with cross-tenant attack tests; named accounts; MFA; salted PBKDF2 (600k) passwords; server-side session revocation | Shipped & tested |
| SHA-256 hashing on every document; field-level provenance with structured citation fragments; pre-storage active-content screening that fails closed; encryption at rest for stored objects | Shipped & tested |
| Sealed, hash-verified completed versions (tamper-evident) with an append-only audit trail enforced at the database layer | Shipped & tested |
| Deterministic human-judgment gates: no approval without a source, contradictions block, exports never advance regulatory state, no legal conclusions from software | Shipped & tested |
| Storage-level WORM retention lock (until it lands we say "tamper-evident", never "immutable") | Planned |
| E&O / cyber insurance (bound at first paid engagements, before any regulated-data work that requires it; current status stated in writing on request) | Planned |
| SOC 2 (control baseline targets OWASP ASVS L2 / NIST SSDF now; certification when buyer demand justifies it) | Planned |
Workspace support covers technical and how-to questions by email, targeted within two business days; it is not a response-time SLA or included consulting. Optional-service delivery commitments are stated in the accepted engagement agreement. We never guarantee a regulatory outcome, agency acceptance, or supplier behavior.
CAA’s calendar is a planning source, not a universal filing ledger. During workspace setup or the start of an optional engagement, PackClose separates producer-to-PRO actions from state-agency filings, then verifies the current registration, report, fee, correction, adjustment, and receipt status for each legal entity and state. Oregon and Colorado are operating programs; California’s regulations are effective while its program-plan process continues. The workpaper preserves the official source and check date behind every account-level status, and never turns a published planning date into an unsupported claim that a filing, invoice, or account-level action occurred. Sources were rechecked 2026-09-04: CAA resource center, Oregon DEQ, and CalRecycle source-reduction guidance.
No. You submit in the portal; we prepare the portal-entry workpaper and record your receipt/status as evidence. We never claim remediation cures noncompliance - we make the remediation defensible.
You, with your reviewer or counsel. We record the decision, its basis, and its date - we never compute it. The same goes for any question that determines whether and what you must report.
No. Any fee figures in our workpapers are labeled illustrative planning math. Invoicing happens through CAA under approved rate schedules - we do not quote, compute, or optimize fees.
The PackClose Workspace maintains evidence and calculations for Oregon, Colorado, and California. Optional Full Data Close services use the same state scope; the fit check confirms the smallest useful hands-on scope before an agreement or invoice.
Not silently. Completed workpaper versions are sealed and tamper-evident; corrections create linked versions with recorded reasons. Estimates are flagged as estimates, then replaced with actuals through a recorded correction - so every kilogram stays traceable to units × component weight and its source document.
No customer data enters consumer AI tools. Model-assisted processing happens only under commercial no-training terms - or not at all, at your election.
Nothing leaves your browser. The 2-minute EPR Status & Exposure Scanner runs entirely client-side - nothing is uploaded, nothing to install, and closing the tab discards everything, including any packaging BOM you paste.
Exposure views and any fee-adjacent figures are illustrative planning math, never a quote. Verify every date and obligation against the official state and CAA sources before relying on it.