Governance · L8

How Vireth holds itself accountable

Every commitment on this page is something the system actually does. Where a claim can be tested, the test result is published here.

How Vireth reasons, stated plainly

Vireth is a rule-based expert system. It uses no machine-learning model and no generative AI, and it never sends your words to one. Every rule is written by people, tied to published guidance, versioned, and tested. That is a deliberate choice: it means every verdict can be traced to its exact cause, and Vireth cannot invent a pattern that doesn’t exist.

Its governance still follows AI risk frameworks (below), because the questions they ask about automated decisions affecting people apply just as much here.

The principles

Intervene, don't just inform

A warning without a next step is a failure. Every result ends in one action you can take.

The human decides

Vireth widens what you can see and explains the risk. Paying, not paying, locking an account, reporting: those choices are yours.

Evidence before conclusion

Every verdict shows the answers behind it, its confidence, the innocent explanations, and what Vireth cannot know.

Consent is the only data source

No scraping, no monitoring. Only what you tell Vireth, in the moment, by choice.

False alarms are harm

Stopping a genuine payment or frightening someone over nothing is a real cost. It is counted and shown, never hidden.

Calm is a capability

Plain words, large targets, one step at a time. A frightened person cannot use good information.

Minimum necessary data

Vireth collects what protects you in this moment and nothing more, however useful it might be later.

Red lines

Leave quickly, always. Every page has a button (or press Escape twice) that hides Vireth instantly and replaces it in the browser history.
Safeguarding first. If someone mentions self-harm, or a child is being threatened with images, the scam flow steps aside and crisis and child-safety routes come first.
No attribution. Vireth has no field for a phone number, name, IP address, email, or location of the other party, so it cannot profile anyone.
No surveillance. Vireth never listens to calls, reads messages, or accesses accounts. It knows only what you tap or type.
Nothing is kept. Vireth does not record your answers, notes, or decisions. The only thing it can save, and only if you press Save, is your own pause rules, country, and age group.
No acting around you. Vireth never contacts, reports, or blocks anyone on your behalf, and never pressures you after you decide.
No certainty claims. Vireth never says something is "safe" or that it "stops all scams".
No silent changes. Every change to the pattern base or reasoning is versioned and listed on the governance page, with its test results.

The contract between you and Vireth

Vireth does	You do
Ask the right questions at the right moment	Decide what actually happened to you
Match your situation against known, sourced patterns	Judge context Vireth cannot see
Explain the risk in plain language	Choose the action, including doing nothing
State its own uncertainty and what it cannot know	Correct Vireth, overrule it, and tell it when it failed
Show the evidence behind every verdict, then forget it	Keep any evidence you need yourself, and decide what to share and with whom

If you reject Vireth’s assessment, your choice governs, always. The disagreement is recorded as a learning signal, and Vireth never nags, pressures, or acts around you.

Every piece of data, and why

Vireth has no accounts, keeps no records, and has no active server database. Its only server endpoint, for anonymous community reports (Phase VI), is switched off and answers “not found”. The browser’s security policy blocks the page from sending data anywhere else. If Vireth can’t say why it holds something, it doesn’t hold it.

What	Why	Where	How long
Your answers and notes	To work out what the situation looks like, on your screen	This page's memory only	Never stored or sent; gone when you leave the page
Vireth's assessment, advice, and the steps you tick	To guide you through the moment	This page's memory only	Never stored or sent; gone when you leave the page
Bank statements and security activity you check (Phase V)	To point out what's worth a second look	This page's memory only	Never stored or uploaded; gone when you leave the page
Anonymous pattern reports (Phase VI, switched off)	To warn others sooner, if you choose to share	Would go to a TRACE server; not active	Only pattern, country, week, and outcome; you could withdraw with a private receipt
Three dates in the redress pack (payment, complaint, bank reply)	To work out your deadlines and fill the dates in your draft letters	This page's memory only	Never stored; gone when you leave the page. Names, bank and account details are left as blanks for you to write in; Vireth never asks for them
Vireth's own pages and code, cached for offline use	So Vireth opens with no signal	This device (browser cache)	Replaced with each new version; contains nothing you entered
Safety plan: your pause rules, country, and age group only. No names, phone numbers, or bank details	Reminders of your own rules in the moment	This device, only when you press Save	Until you change or delete it

You can clear your saved pause rules at any time from the Safety plan page.

Evaluation results

23,862 / 23,862 checks passed

Engine 1.2.0, knowledge 2026.10.1. Run October 16, 2026. The same suite must pass before every release.

Knowledge base integrity181/181
Real-world scenarios (true positives and false-alarm protection)126/126
Invariants across every assessment, including 3,000 random ones23,353/23,353
Hostile and malformed input9/9
Structural privacy1/1
Nothing is kept: only the safety plan can be saved, and old saved data is erased5/5
Recovery deadlines and blank draft letters73/73
Checking your own statement and security activity (Phase V)28/28
Anonymous sharing rules, including while switched off (Phase VI)22/22
stages64/64

Reasoning evaluation

Benchmark of 25 scams and 15 genuine situations: detection 100%, false alarms 0%.
Scams described only in your own words, in evasive language never used to tune the rules: 4 of 5 caught. This is the honest measure; the structured questions remain the main protection.
Ordinary sentences wrongly flagged: 0 of 10.
Fairness: 0 differences in verdict across 320 country and age-group comparisons.

These benchmarks were written by the team that built the rules. Independent testing with real cases is the next step.

Stress test: 19/19 checks passed

Volume, hostile input, corrupted storage, and consistency checks (the same answers must always give the same result; answer order and country must never change the verdict; verifying something yourself must never raise the advice).

100,000 random assessments in 2.5 s; 99% took under 0.1 ms
Worst adversarial text input: 1.6 ms

These are tests against written scenarios. Vireth keeps no records, so it has no real-world outcome data to report.

The pattern base

24 versioned patterns. Each carries its sources, its innocent explanations, and what it cannot know. A pattern is marked definitive only when it describes something legitimate organisations never do, and it has to say why.

Fake police or 'digital arrest' · v1 · definitive

Someone posing as police, a court, customs, or an investigating agency says you are linked to a crime, keeps you on a call or video, and demands money to 'clear' your name. No police force in India, the UK, or Australia arrests people over a call or collects money this way.

Why definitive: No genuine police force, court, or agency demands payment over a call or video to avoid arrest.

Sources: Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs; Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police); Scamwatch, National Anti-Scam Centre (ACCC, Australia).

'Safe account' transfer · v1 · definitive

Someone says your money is at risk and must be moved to a 'safe', 'secure', or 'holding' account to protect it. The new account belongs to the criminal. Banks and regulators never ask you to move money to keep it safe.

Why definitive: Banks, police, and regulators never ask anyone to move money into another account to protect it.

Sources: UK Finance; Reserve Bank of India; Scamwatch, National Anti-Scam Centre (ACCC, Australia).

One-time code or PIN theft · v1 · definitive

Someone asks you to read out or forward a one-time code, OTP, or PIN. That code is the key to your account or a payment. Whoever has it can take over the account or approve a transfer.

Why definitive: Codes exist so that only you can approve an action. No bank, company, or agency needs you to tell them one.

Sources: Reserve Bank of India; National Cyber Security Centre (UK); Scamwatch, National Anti-Scam Centre (ACCC, Australia).

Remote-access takeover · v1

Someone asks you to install an app or share your screen so they can 'help' or 'fix' something. Once connected, they can watch you type passwords and codes, or control your phone or computer directly.

Sources: Australian Cyber Security Centre; National Cyber Security Centre (UK); Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Official demanding gift cards or crypto · v1 · definitive

Someone claiming to be a government office, tax office, bank, or company wants payment in gift cards or cryptocurrency. These payments are hard to trace and nearly impossible to reverse, which is why criminals ask for them.

Why definitive: Government bodies, banks, and legitimate companies do not take payment in gift cards, and do not demand crypto to settle a bill or a fine.

Sources: Scamwatch, National Anti-Scam Centre (ACCC, Australia); Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police); Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Changed bank details (invoice redirection) · v1

A message that looks like it comes from a supplier, landlord, solicitor, or builder says their bank details have changed. The email or account may have been hacked or spoofed, and the new details belong to a criminal.

Sources: UK Finance; National Cyber Security Centre (UK); Scamwatch, National Anti-Scam Centre (ACCC, Australia).

Family member on a new number · v2

A message or call from 'your son', 'your daughter', or a friend says they lost their phone or are in trouble and urgently need money. Criminals rely on love and panic to stop you checking.

Sources: Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police); Scamwatch, National Anti-Scam Centre (ACCC, Australia).

Investment or trading scam · v1

An opportunity, often met through social media, a messaging group, or a new online contact, promises high or guaranteed returns. Early 'profits' appear on a dashboard, but withdrawing needs more fees. The platform is controlled by the criminals.

Romance or relationship scam · v1

Someone you know only online builds a close relationship, then needs money for an emergency, travel, fees, or an 'investment'. They usually have reasons why they can never meet or video call properly.

Sources: Scamwatch, National Anti-Scam Centre (ACCC, Australia); Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police).

Job or paid-task scam · v1

An easy job or 'task' (liking videos, rating products, reviews) pays small amounts at first, then asks you to deposit money to unlock bigger earnings or withdraw what you've made.

Sources: Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs; Scamwatch, National Anti-Scam Centre (ACCC, Australia); Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police).

Pay a fee to release money · v1

You are told a prize, refund, loan, inheritance, parcel, or payment is waiting, but a fee, tax, or charge must be paid first. Once paid, another fee appears, and nothing is ever released.

'Scan or approve to receive' trick · v3 · definitive

Someone, often a buyer or a 'refund' agent, asks you to scan a QR code, enter your PIN, or approve a payment request so you can 'receive' money. Scanning a payment QR code opens a payment from you, and entering your PIN or approving a collect request sends the money. None of these ever brings money in.

Why definitive: On UPI and similar systems, you never need to scan a code, enter a PIN, or approve a request to receive money. Those steps only ever authorise a payment out of your account.

Sources: Reserve Bank of India; Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Account-block or KYC threat · v1

A message or call says your bank account, SIM, card, or KYC will be blocked unless you act right now, usually by clicking a link, calling a number, or sharing details.

Sources: Reserve Bank of India; Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs; National Cyber Security Centre (UK).

Intimate image extortion (sextortion) · v1 · definitive

Someone threatens to share intimate images or videos unless you pay or send more. Paying rarely ends it. This is a crime against you, and you are not in trouble.

Why definitive: Threatening to share intimate images for money is extortion in every one of Vireth's countries.

Sources: eSafety Commissioner (Australia); National Cyber Security Centre (UK); Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Fake money-recovery offer · v1

After someone has lost money, a 'recovery agent', lawyer, hacker, or even fake police officer offers to get it back, for a fee, or asks for access to your accounts. They often know details of your loss because they, or people they work with, took the money in the first place. It is the same crime, a second time.

Sources: Report Fraud, formerly Action Fraud (UK national fraud reporting service, City of London Police); Scamwatch, National Anti-Scam Centre (ACCC, Australia); Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Fake customer-care number · v1

Criminals publish fake 'helpline' numbers for banks, airlines, delivery firms, and apps in search results, ads, and social media. When you call for help, they ask for a code, remote access, or a small 'refund' or 'verification' payment.

Sources: Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs; Reserve Bank of India; National Cyber Security Centre (UK).

Urgent bill, fine, or disconnection · v1

A message or call says your electricity, phone, or other service will be cut off tonight, or that you owe a traffic fine or penalty, unless you pay right now through a link, a number, or an app they name.

Loan-app harassment and extortion · v1 · definitive

An instant-loan app or its agents threaten to message your contacts, share edited photos, or shame you publicly unless you pay far more than you borrowed, often after the app copied your contacts and photos. This is harassment and extortion, not debt collection.

Why definitive: No lawful lender threatens to shame you to your contacts or share your photos to collect a debt.

Sources: Reserve Bank of India; Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

SIM swap · v1

Your mobile number has been moved to a SIM the criminal controls, so your texts and codes now go to them. The first sign is often sudden 'no signal' or 'no SIM', followed by bank or login alerts.

Sources: Australian Cyber Security Centre; Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs; National Cyber Security Centre (UK).

Email account takeover · v1

Someone has access to your email. Because email is how most other accounts reset their passwords, it is the key account to recover first.

Sources: National Cyber Security Centre (UK); Australian Cyber Security Centre.

Messaging account hijack · v1

Someone has registered your messaging account (such as WhatsApp) on their phone, usually after tricking you into sharing a verification code. They then message your contacts asking for money.

Sources: National Cyber Security Centre (UK); Scamwatch, National Anti-Scam Centre (ACCC, Australia); Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs.

Bank or payment account compromise · v1

Money has moved, or someone has access to your bank or payment app. Speed matters most here: the faster the bank knows, the better the chance of stopping or recovering funds.

Sources: Reserve Bank of India; UK Finance; Scamwatch, National Anti-Scam Centre (ACCC, Australia).

Device under someone else's control · v1

You installed an app or shared your screen because someone asked. They may still be able to see or control your device, so anything you type on it may be visible to them.

Sources: Australian Cyber Security Centre; National Cyber Security Centre (UK).

Social or other account takeover · v1

Someone has signed in to one of your accounts. They may use it to message your contacts, post scams, or reset other accounts.

Sources: National Cyber Security Centre (UK); Australian Cyber Security Centre; eSafety Commissioner (Australia).

Versions and changes

Current: engine 1.2.0, knowledge 2026.10.1. No silent improvements: every change is listed with its evaluation.

engine 1.2.0 / knowledge 2026.10.1

2026-10-05

Correction: the UK's national fraud reporting service is now called Report Fraud (reportfraud.police.uk) and no longer Action Fraud. The phone number, 0300 123 2040, is unchanged. The UK help, the recovery deadlines, the draft-letter instructions, and the source list were updated. No change to reasoning or advice.

engine 1.2.0 / knowledge 2026.09.4

2026-10-04

Vireth no longer keeps anything. Saved case files, the case-file verifier, outcomes, and the scorecard were removed: checks are for the moment, and nothing is recorded. The only thing that can be saved, if you press Save, is your own pause rules, country, and age group. Anything earlier versions saved is erased from the device when the app loads. The recovery deadlines and draft letters now stand alone on their own page. The reasoning and advice are unchanged.

engine 1.2.0 / knowledge 2026.09.4

2026-09-27

Notes detector: red-team testing found it caught plain wording but none of the soft, coached phrasings scammers use ("read me the numbers that came by message", "a protected wallet", "a helper program"). Added rules for those shapes of request. Testing also found five false alarms, three of them in the original keyword rules (for example "the OTP came and I used it myself" and "gift cards for my niece's birthday"). Those rules now need a request, not just a word.

engine 1.2.0 / knowledge 2026.09.3

2026-09-27

Renamed to TRACE Vireth. The earlier working name turned out to be in use elsewhere. The seven design principles are now numbered P1 to P7. Case files use the format trace-vireth-case/1. No change to reasoning or advice.

engine 1.2.0 / knowledge 2026.09.3

2026-09-24

Found by the stress test: when several patterns matched, the verdict came from the most confident one, so a milder pattern could outrank a definitive one (such as image extortion), and adding "I checked it myself" could reorder them and raise the advice. The verdict now always comes from the most decisive pattern matched. Also hardened: malformed case files, corrupted storage, invalid dates, and impossible amounts are now rejected safely instead of crashing or being counted.

engine 1.1.0 / knowledge 2026.09.3

2026-09-24

Accuracy correction after an external check: the 'scan or approve to receive' pattern (v3) no longer says scanning a QR code by itself sends money. Scanning opens a payment from you; entering your PIN or approving is what sends it. The advice is unchanged: none of these ever brings money in.

engine 1.1.0 / knowledge 2026.09.2

2026-09-24

Four new patterns: fake money-recovery offers, fake customer-care numbers, urgent bill or fine scams, and loan-app extortion. Family impersonation (v2) now recognises AI-cloned familiar voices. The 'scan to receive' pattern (v2) now covers UPI collect requests. Hindi and Hinglish keywords added to the notes detector. Pause questions now ask the most telling questions first. Engine 1.1.0: a match confirmed by two or more independent answers counts as corroborated (moderate confidence); unsolicited recovery offers and numbers found online now count as warning signs; a familiar voice alone never does.

engine 1.0.0 / knowledge 2026.09.1

2026-09-24

First release. 19 patterns across Pause, Lockdown, and the live-call companion. Deterministic reasoning, proportionality cap, coaching awareness, safeguarding red line, and hash-chained case records.

Standards alignment

NIST AI Risk Management Framework

Applied to Vireth's automated reasoning, which is rule-based rather than machine learning. Designed around its trustworthiness characteristics: valid and reliable, transparent, explainable, privacy-enhanced, accountable. An alignment, not a certification.

ISO/IEC 42001 (AI management systems)

The future certification target, ahead of any machine-learning capability. Not certified today.

ISO/IEC 27035 (incident management)

The discipline behind how Vireth guides a response: detect, assess, respond.

India: Digital Personal Data Protection Act 2023

TRACE receives no personal data. Everything you enter stays on your device, under your control.

Australia: Privacy Act 1988 and the Scams Prevention Framework

Privacy by architecture: nothing is collected or kept. Vireth points people to the routes and rights that apply when a scam is reported.

UK GDPR and the APP reimbursement rules

No personal data leaves the device; the recovery page shows the reimbursement rights and deadlines that apply.

Known limitations

Vireth only knows what you tell it. It cannot see messages, calls, links, or accounts, and cannot confirm who anyone is.
Notes are matched by keywords, not understanding. A scam described in unusual words may not be recognised; the structured questions exist so this never matters alone.
The pattern base covers common attacks in India, the UK, and Australia. New tactics appear constantly, and a "no known pattern" result never means "safe".
Vireth keeps no record, so it cannot give you evidence. If you may need it, take screenshots of messages and keep your call log and bank statements yourself.
Vireth does not measure real-world outcomes, because it keeps nothing to measure them with. Its accuracy is tested on written scenarios, which are published.
Combining patterns across users (Phase VI) is designed but switched off, and has no client in the app.
Vireth reads only the files and text you give it. Live connections to bank accounts need regulatory authorisation in each country (such as India's Account Aggregator framework, UK Open Banking, or Australia's Consumer Data Right), which Vireth does not have.
Bank statements come in many formats. If a statement can't be read, Vireth says so rather than guessing.
Verified local routes exist for India, the UK, and Australia. Elsewhere, Vireth gives general guidance with no phone numbers, rather than risk a wrong one.
Vireth is in English only for now. The notes detector also recognises some Hindi and Hinglish phrases.
Leave quickly removes the current page from the back button, but earlier Vireth pages may still be in the browser's history. Private or incognito browsing avoids leaving any history.
Vireth is not a replacement for the police, your bank, a lawyer, or your own judgement.

What Vireth will never be

A profiler of people. It assesses situations, never who "looks like" a criminal.
An attacker-tracing system. Attribution belongs to law enforcement.
A surveillance layer. Consent or nothing.
A replacement for your judgement.
A promise of certainty.

Break it, please

Security researchers and skeptics are invited to find ways around Vireth before criminals do. Every bypass is a gift. Honest marketing: Vireth does not stop all scams and does not claim to.