Skip to content
Home
Products
Products
NucleusPulsarSupernovaPhalanx
Trust

The best verdict an email can get is incomplete

Outlook, Gmail and Apple Mail rendering cannot be reproduced locally, so one gate says could not measure, and Nucleus will not round that up to a pass. Each guarantee below names what holds it.

  • A gate that could not measure is never counted as a pass
  • Every gate's reason is written next to it
  • The gate that cannot measure names what a person must check before sending
Join the waitlistWhy believe us

Verdict

an email, at its best

incomplete

could not measure 1
  1. email.size: pass
  2. email.no-script-or-external: pass
  3. email.inline-styles: pass
  4. email.table-layout: pass
  5. email.images: pass
  6. email.width: pass
  7. email.preheader: pass
  8. email.dark-mode: pass
  9. email.compliance-footer: pass
  10. email.tokens-only-colors: pass
  11. email.plain-text: pass
  12. email.chromium-render: pass
  13. email.client-render: could not measure
  • 12 pass
  • 0 fail
  • 1 could not measure
email.client-rendercould not measure

Outlook (Word engine), Gmail and Apple Mail rendering cannot be reproduced locally. Check the email in real clients, or a rendering service, before it is sent.

Before it is sent, a person must check

  • Outlook for Windows (the Word rendering engine)
  • Gmail on the web and in its apps, including a non-Gmail account (which drops <style> entirely)
  • Apple Mail on macOS and iOS
  • Every client with images blocked
  • The plain-text part in a text-only client
The engine's 13 email gates, in the order they run. When the 12 that can run locally pass, the verdict is incomplete, because email.client-render can never pass locally.
  • 13

    gates an email is checked against

  • 12

    of them can be measured locally

  • 1

    cannot, and the verdict says so

  • 3

    outcomes a gate can give: pass, fail and could not measure

The rule

Pass means every gate passed. Nothing else does.

Every gate answers pass, fail or could not measure. The verdict is then one of three words, by one rule, applied in one order. A page that hangs, spins or runs out of memory while it is checked fails. Any other error a gate throws is recorded as could not measure. An answer the engine cannot read is recorded as could not measure.

pass
Every gate measured and passed.
fail
At least one gate failed, with its reason.
incomplete
Nothing failed, and something could not be measured.
Why believe the rest

The verdict rule

libs/nucleus/src/gate.ts
export type GateStatus = 'pass' | 'fail' | 'could-not-measure';lines 13 to 38 not shown/** * `fail`: at least one gate failed. * `incomplete`: nothing failed but something could not be measured. * `pass`: every gate measured and passed. */export type Verdict = 'pass' | 'fail' | 'incomplete';lines 45 to 50 not shown/** * `pass` only when EVERY result is exactly `pass`. Anything else that is not a * `fail` (a `could-not-measure`, or a status this frame does not know) is * `incomplete`. Absence of a denial and approval must never be the same answer: * an unrecognised status is an abstention, not a green light. */export function verdictOf(results: readonly GateResult[]): Verdict {  if (results.some((result) => result.status === 'fail')) return 'fail';  return results.every((result) => result.status === 'pass')    ? 'pass'    : 'incomplete';}
Copied from the engine. Anything that is not a fail, and not every gate passing, is incomplete.
Why believe us

Every promise here names what holds it

Most are held by code that a test runs. One is held by a written decision, and its card says so.

  • A gate that could not measure is never a pass

    Outlook's rendering, at the top of this page, is the example.

    Held by
    The verdict rule, and the tests that run it.

  • You pick. No model ranks the directions.

    Directions are checked for being different, never ranked. Each shows the brand risks noted by the model that proposed it. A review's record holds the pick you made.

    Held by
    The review record, which stores the pick a person made, and a check for difference that keeps directions in the order they came.

  • Nucleus does not train on your data

    Not on your briefs, picks, comments or approvals. Your briefs, picks and approvals tailor only your own future designs.

    Held by
    A written decision, not a check. What tailors your designs is read for your account alone, and a test holds it.

  • Every preview runs on a host apart from the app

    Sandboxed, sent with no cookie, and refused every fetch and form post by its own policy.

    Held by
    Its response headers, a hostile page tested in real Chrome, and, in production, an app that frames previews from that host alone.

  • Your SOW and PRD are read for your designs alone

    Only Claude models we've cleared for sensitive data read them, with model training switched off.

    Held by
    The tenant on your session, a check on the document's class that clears only that model, made before any model is called, and a test that one account's documents never reach another account's designs.
  • Not claimed

    What we do not claim

    • A security certification. Nucleus holds none today, so none is shown.
    • Customer names, logos or numbers. Nucleus is not open yet.
    • A render check in Outlook, Gmail or Apple Mail. That gate says could not measure.
    Status
    Not true today, so not said.
See how it works
Previews

A design can run. It cannot read your session.

Every preview is treated as a stranger's code, whoever wrote it. It is served from a preview host apart from the app and from this site, behind a signed link that expires. Its scripts run, so the motion is real, and its policy refuses every fetch and form post.

  • Fetches, form posts and pop-ups are refused
  • No cookies: a preview response never sets one
  • Its own origin, even when the link is opened on its own
Join the waitlist

Response headers

every preview is served with these
content-security-policy
  • sandbox allow-scripts;
  • default-src 'none';
  • script-src 'unsafe-inline';
  • style-src 'unsafe-inline';
  • img-src data:;
  • font-src data:;
  • media-src data:;
  • connect-src 'none';
  • frame-src 'none';
  • object-src 'none';
  • form-action 'none';
  • base-uri 'none';
  • frame-ancestors (the app's origin)
x-content-type-options
nosniff
cache-control
no-store
cross-origin-resource-policy
same-site
cross-origin-opener-policy
same-origin
referrer-policy
no-referrer
set-cookie
never sent
The preview host's header contract. frame-ancestors names the app's origin: only the app may frame a preview.
Your documents

Only Claude reads your SOW or PRD

Your SOW and PRD are read only by Claude models we've cleared for sensitive data, with model training switched off. Any other model is refused before anything is sent.

  • Your tenant comes from your session. A request cannot name another
  • A SOW or a PRD is always sensitive, by its type
  • Only a cleared model may read one. Any other model is refused before the call.
How client review works

Refused before sending

the document's class, checked against the model's
sample refusal
Document
SOW (illustrative)
Data class
sensitive
Model cleared for
general
Outcome
refused before any call

What the check returns

{ cleared: false, requested: "sensitive", clearedFor: ["general"] }
What the data-class check returns inside Nucleus when a model cleared only for general data is asked to read a SOW, and the words its refusal opens with. Every value here is illustrative.
Questions

Straight answers about trust

Do you train on my data?
No. Nucleus does not train on your data: not on your briefs, picks, comments or approvals. That promise rests on a written decision, not on a check, and this page says so. Your briefs, picks and approvals do tailor your own future designs, and no one else's.
Why is an email's best verdict incomplete?
An email is checked against 13 gates, and 12 of them can be measured locally. The last, rendering in Outlook, Gmail and Apple Mail, cannot be reproduced locally, so it says could not measure. A could not measure is never counted as a pass: if no gate failed, the verdict is incomplete (a failed gate still makes it fail), and the gate lists what a person should check in real clients before the email is sent.
Can a preview read my session?
No. A preview is served from a preview host apart from the app, in an origin of its own even when its link is opened on its own, so it cannot read the app's cookies or the page it is shown in. A preview response never sets a cookie, and its policy refuses every fetch and form post.
Who reads my SOW and PRD?
Claude, in models we've cleared for sensitive data, with model training switched off. Inputs are deleted within 30 days. A model we haven't cleared is refused before anything is sent.
Who decides which design is best?
You do. Directions are checked for being different from each other, never ranked, and no model picks one. Each shows the brand risks noted by the model that proposed it. A review's record holds the pick you made.
Do you hold a security certification?
Not today, so this page shows none.

Know what was checked, and what could not be

Nucleus is not open yet.

Join the waitlist