Service status

This page is written by hand at each deploy and reflects what the deployment could do at that moment. The system's own answer, live and always current, is at /readyz — trust that over this page if the two disagree.

How to read it

/readyz returns 503 until every blocking item is satisfied, and lists what is missing. /healthz reports storage, the boot restore and the backup state. Neither requires a login, because a status endpoint you have to authenticate to is not a status endpoint.

What works with nothing configured

Applicant intake, storage with encrypted personal data, identity and roles, two-factor, scoped API keys, the decision engine including the blocks no setting can disable, MRZ check-digit validation (arithmetic we do ourselves), our own device and velocity signals, the audit trail, signed webhooks, and the whole product in 14 languages.

Sanctions screening — running, from the official lists

Sanctions screening is not a commercial data problem: the authorities publish their lists. Hawk Ai loads them directly and screens against them in process:

Roughly 26,000 designations and 67,000 searchable names including aliases, refreshed daily — the lists change several times a week, so a list loaded once is a control that only looks like it is working. GET /v2/screening/lists reports what is loaded, when it was last refreshed, and flags it as stale past seven days.

Matching is token-level with Jaro-Winkler similarity, so a transliteration or a reordering still matches: *SADAM HUSAYN AL-TIKRITI* and *Al-Tikriti, Saddam Hussein* both find the designation. A matching year of birth promotes a candidate; a mismatching one demotes it. Against a set of ordinary names the referral rate is about 5%, which is what this kind of screening costs — a hit is a candidate for a human to confirm, never a decision.

What still needs a provider connected

Document authenticity, face matching and liveness, PEP and adverse-media screening, e-mail and phone intelligence, and the digital footprint. These are things a KYC platform buys or trains; none is simulated here. Until each is connected it returns not_configured and blocks automatic approval.

PEP and adverse media are worth separating out: sanctions lists are public, those data sets are commercial. Having sanctions screening running does not give you either, and /readyz keeps them as distinct items so nobody can mistake one for the other.

Every feature, with its real status

The full catalogue is published at /features: 500 entries, each one marked built, partial or not started, each built one naming the file you can check it against. Anything that depends on a provider is shown one step lower until the provider actually answers on this deployment, so the page describes what is running rather than what is planned. The same data is at GET /v2/features.

Incidents

None to report. When there is one it will appear here with what happened, what we did, and what we changed so it does not happen again.