BASIS · TEAM HUDDLE
FOR DAMIEN WINBERG AND JASON CARLOS
PAGE 1 OF 15
[basis-io]
Team huddle.
Project plan for the [basis-io] prototype, version 1.0.
Friday 16 October 2026
BASIS · TEAM HUDDLE
01 · WHY WE ARE HERE
PAGE 2 OF 15
Why we are here
Three things to agree.
1. Prototype build
Airlock
- Upload portal
- Redaction and tokenisation
- Token key
- Job number
Vault
- Matching
- Workflow
(Testing on dummy data.)
2. Roles and responsibilities
- Dean · product build
- Jason · SME, subject matter expert. Testing, and confirms usability of the product.
- Damien · executive oversight
Changed on the call · 16 Oct
3. Timelines
Dates on slide 10.
Agreed on the call: two calls a week, prototype working in two to three weeks.
BASIS · TEAM HUDDLE
02 · ROLES AND RESPONSIBILITIES · AGREED
PAGE 3 OF 15
Roles and responsibilities · agreed 16 Oct
Who does what.
| Name | Role | Steps | Milestone date |
|---|---|---|---|
| Dean | Product build | Azure and repo set up. Upload portal. Redaction and tokenisation with Presidio. Token key and job number. Agents on tokens. Vault matching and workflow. | Agreed 16 Oct. Portal first, redaction and tokenisation for testing late next week. |
| Jason | SME, subject matter expert | Supplies the dummy client pack and the document types advisers send. Tests each piece as it lands. Confirms usability of the product. | Agreed 16 Oct. Dummy data this week. |
| Damien | Executive oversight | Keeps the build to APP, SOC 1 and 2 and ISO 27001. Brings the licensee view: what a licensee would accept and ask for. | Agreed 16 Oct. Shareholders agreement to finalise. |
Roles agreed on the call, 16 October. Milestone dates on slide 10.
BASIS · TEAM HUDDLE
03 · FIG.01 · PLATFORM SCHEMATIC · PROGRESS REPORT, 5 OCT 2026
PAGE 4 OF 15
![[basis-io] platform schematic, Figure 1 from the progress report of 5 October 2026](fig01.png)
BASIS · TEAM HUDDLE
04 · FIG.02 · THE SAME DRAWING · AIRLOCK AROUND EVERYTHING
PAGE 5 OF 15
BASIS · TEAM HUDDLE
05 · THE FIVE TASKS, IN ORDER
PAGE 6 OF 15
What gets built
Five tasks, in this order, tested on dummy data.
| # | Task | What it does | Completed when | Status |
|---|---|---|---|---|
| 1 | Upload portal | Adviser signs in, starts a job, uploads the SoAR (SOA request), the CPF (client profile) and the supporting documents. Simple enough to use without instructions. | Working on dummy documents. | Not started |
| 2 | Redaction and tokenisation | Presidio finds the PII in each document, redacts what is not needed and replaces the rest with tokens. One tokenised copy per document. | Jason’s pack goes in; clean copies come out; nothing identifying left. | Not started |
| 3 | Token key and job number | The key that maps tokens back to real values is written to the Key Store in Azure. A job number is issued and every file carries it. | Key readable only by the Airlock; the Vault cannot read it. | Not started |
| 4 | Two agents, tokens only | A local agent in the Airlock hands the tokenised files to the Vault agent, which runs on an LLM. They talk in tokens and job numbers. | A full exchange with no real value crossing the line. At sign-off both agents retire and their markdown files sit in the Evidentiary Layer. | Not started |
| 5 | Matching and workflow in the Vault | The three sets are matched, outstanding items go back to the adviser, strategy is confirmed, work commences. | Jason confirms the matching is right on the dummy pack. | Not started |
BASIS · TEAM HUDDLE
06 · THE PORTAL · PROPOSED MOCK-UP
PAGE 7 OF 15
The portal · proposed mock-up *
One screen. Simple enough that no one needs to be shown.
[basis-io]
Job number
BIO-2026-0142
Adviser · J. Carlos
1
Received
2
Checked
3
Tokenised
4
Ready
Client reference
Bob and Tracy · dummy pack
SoAR
SOA request · drop file
CPF
Client profile · drop file
Supporting docs
Statements, policies · drop files
Other
Anything that does not fit
Tell us about this job. What the client wants, what is missing, anything the paraplanner should know…
Captured by the local agent in the Airlock. Tokenised before it goes anywhere.
Send
Actions for this upload
Client reference entered
Upload SoAR
Upload CPF
Upload supporting documents
Add anything in Other
Confirm and send to the Airlock
Status comes back to this screen: received, checked, tokenised, ready. Outstanding items appear here too.
* Proposed mock-up. What this looks like is not decided yet.
BASIS · TEAM HUDDLE
07 · THE PRINCIPLES WE BUILD TO
PAGE 8 OF 15
The principles we build to
APP, SOC 1 and 2, ISO 27001.
| Framework | What it is | What it means for this build |
|---|---|---|
| APP | The thirteen Australian Privacy Principles under the Privacy Act 1988. | Collect only what the job needs. Redact and tokenise before anything is stored or sent to a model. Keep the key apart. |
| SOC 1 | An auditor’s report on controls over financial reporting. | Every action logged with who, what and when, so a licensee’s auditor can follow a job end to end. |
| SOC 2 | An auditor’s report that security controls were in place and operated over a period. | Access by policy, MFA on every login, change control on every code change, the log as the record. |
| ISO 27001 | The international standard for an information security management system. | Name the controls as each piece is built, so the paperwork exists when a licensee asks. |
Dummy data only until Damien is satisfied on all four.
BASIS · TEAM HUDDLE
08 · DEVELOPMENT TOOLS
PAGE 9 OF 15
Development tools
Development tools.
MICROSOFT
Az
Azure
The platform. One subscription, Australia East.
MICROSOFT
En
Entra External ID
Sign-in and MFA for advisers, paraplanners and licensees.
MICROSOFT · OPEN SOURCE
Pr
Presidio
Redaction and tokenisation. Task 2.
AZURE
KV
Key Vault
The Key Store. Token keys, access by policy. Task 3.
AZURE
CA
Container Apps
Runs Presidio and the local agent in the Airlock.
AZURE
Az
Blob, Functions, SQL
The Airlock and Vault stores, the job number, the log.
VERCEL
Vercel
Serves the portal screens. No client data on it.
GITHUB · ANTHROPIC
GitHub and Claude Code
Where the code lives and how it gets written.
The LLM behind the Vault agent is chosen during task 4. AI Foundry in Australia East is the likely route. Microsoft marks are placeholders until the logo files are supplied.
BASIS · TEAM HUDDLE
09 · DATES AND MILESTONES
PAGE 10 OF 15
Dates and milestones
Six dates. Marked off after each call. Last update 18 Oct, evening.
Changed on the call · 16 Oct · cadence agreed, dates stand
| Date | Milestone | What Jason and Damien see | Status |
|---|---|---|---|
| Mon 20 Oct | Azure set up (done 18 Oct). Repo set up (done 18 Oct). Dummy pack from Jason. | Nothing yet. Dean confirms by email. | Done |
| Fri 31 Oct | Task 1. Portal upload working on dummy documents. | A link. Upload the pack, see the status line. | Not started |
| Fri 14 Nov | Tasks 2 and 3. Redaction, tokenisation, key and job number. | The tokenised copies of the pack beside the originals. | Not started |
| Fri 28 Nov | Task 4. The two agents talking on tokens. | A log of the exchange with no real value in it. | Not started |
| Fri 12 Dec | Task 5. Matching and workflow in the Vault, first pass. | Outstanding items and the summary on the dummy pack. Jason tests. | Not started |
| Fri 19 Dec | Review. What works, what does not, plan for the new year. | A short call. Damien’s view on the four principles. | Not started |
Two calls a week · to 19 Dec
Tuesday 11:30, one hour, Dean, Jason and Damien, from 20 October. Friday 11:30, thirty minutes, Dean and Damien, from 23 October.
In between
A Teams channel for questions, short videos and decisions. Reach out to each other whenever it is needed.
Why the pace
A working prototype in two to three weeks gives us the story for the pre-seed raise, then into the hands of customers and paraplanners.
BASIS · TEAM HUDDLE
FRIDAY 16 OCTOBER 2026
PAGE 11 OF 15
Next steps.
On the call
Agree the five tasks, the roles and the dates. Change anything that is wrong.
After the call
Done 16 October. Slides that moved carry a “changed on the call” tag. Same link.
Then
Dean starts on Azure and the portal. Jason sends the dummy pack and the document types. The Teams channel opens.
BASIS · TEAM HUDDLE
FRIDAY 16 OCTOBER 2026
PAGE 12 OF 15
Questions.
Open for discussion.
BASIS · TEAM HUDDLE
A1 · THE PLATFORM
PAGE 13 OF 15
Appendix · Glossary · The platform
The platform, by name.
| Term | What it means | Where it is in this build |
|---|---|---|
| Airlock | The outer secured box. Everything that can identify a client stays inside it. Figure 1’s Phase 1 is its first container. | Tasks 1 to 4. Azure, Australia East. |
| Vault | Inside the Airlock. Works on tokens and job numbers only. Never holds a key. Figure 1’s Phase 2 and 3. | Task 5. Matching and workflow. |
| Key Store | Where the token keys live. Azure Key Vault. Readable by the Airlock, not by the Vault. | Task 3. |
| Evidentiary Layer | Figure 1’s API layer, renamed. The semantic layer. Notes, logs, jobs, and the markdown file each agent writes when it retires. | Task 4 writes the first agent files into it. The full layer is roadmap. |
| Advice Workspace | Figure 1’s Workspace. Where the paraplanner works a job. | Roadmap. |
| Compliance Workspace | Figure 1’s Backend compliance. The licensee’s login, with its own agent. | Roadmap. |
| Job number | The number a job gets at the start. Every file, token and log entry carries it. | Task 3. |
BASIS · TEAM HUDDLE
A2 · DATA
PAGE 14 OF 15
Appendix · Glossary · Data
How client data is handled.
| Term | What it means | Where it is in this build |
|---|---|---|
| PII | Personally identifiable information. Anything that names a client or can be joined to name one. | Found by Presidio in task 2. |
| Redaction | Removing a detail from a document entirely. | Task 2, for details the job does not need. |
| Tokenisation | Replacing a detail with a placeholder that stands in for it, the same one every time it appears. | Task 2: names, dates of birth, addresses, contacts, account numbers. |
| Token | The placeholder itself. Means nothing without the key. | Everything the Vault and the agents see. |
| Token key | The list that maps each token back to its real value. Holding it is the same as holding the data. | Task 3. Key Store only. |
| Rehydration | Putting the real values back, using the key, so a person can read the file. | Roadmap. Workspaces only, never the Vault. |
| Dummy data | Invented client files that look real and contain no real person. Jason’s Bob and Tracy pack. | Every test in this phase. |
BASIS · TEAM HUDDLE
A3 · MODELS AND TOOLS
PAGE 15 OF 15
Appendix · Glossary · Models and tools
Models and tools.
| Term | What it means | Where it is in this build |
|---|---|---|
| Local agent | A small language model running in our own container in Azure. Nothing leaves the resource group. | Task 4, in the Airlock. |
| LLM | A large language model run by a provider as a service. More capable. The data goes to that service, so region and terms matter. | Task 4, the Vault agent. Sees tokens only. |
| Agent | A model given a job, its files and its rules. It works through them, reports back, and is retired at sign-off. Its history goes to the Evidentiary Layer as a markdown file. Nothing stays alive. | Task 4: one in the Airlock, one in the Vault. |
| Presidio | Microsoft’s open-source tool for finding and replacing PII in text and documents. | Task 2. |
| Entra External ID | Microsoft’s sign-in service for customers and partners. Invite-only accounts, roles, MFA. | Task 1, the portal login. |
| MFA | Multi-factor authentication: a password plus a second proof, here the Authenticator app on a phone. | Every login. |
| Claude Code | Anthropic’s coding agent, run from the terminal. Writes the code under Dean’s direction. | Dean’s build tool. Dummy data only. |