What we have — and haven't — proven

EditRoute acts on your behalf with your clients, so you should know exactly where its limits are. This page is updated with each release.

Capability	Status	Evidence
Objective states: Ready to edit, Ready to revise, Version approved, Delivered	Built	Deterministic checks in code; automated tests for each state and for false-state cases (silence, timers, old-version approval, wrong exports)
Exception inbox with evidence, actions taken, and the exact decision needed	Built	Every escalation is reason-coded; the worker resumes after your decision
Input chasing: missing vs. inaccessible vs. promised later vs. does not exist	Built	Automated tests; obsolete reminders stop before they send
Feedback: vague-note clarification, reviewer conflicts, amendments after freeze	Built	Automated tests; EditRoute never chooses a creative solution or a winner between reviewers
Project email (Resend) in and out	Built, needs live verification	Signature checks, dedupe and retry of failed inbound mail are implemented; not yet run against a live domain
Google Drive (selected files, drive.file)	Built, needs live verification	OAuth and metadata checks implemented; folder behaviour must be tested with real accounts
Model interpretation of messy replies (OpenAI or Anthropic)	Built with a rules fallback	The policy layer decides every change; model accuracy on real studio email is not yet measured
Frame.io review sync	Not yet supported	Clients give notes by email or their project page; your review tool stays the player
Media inspection (FFprobe)	Not yet supported	Checks that need real media stay “Not checked” and go to the studio
Customer results (time saved, retention)	Not measured	We have no customer data yet and won't publish savings until we do

How EditRoute is allowed to act

Every client-facing action starts in “ask me first”. Automatic mode is per action, after a dry run, and one switch pauses everything.
A model may read a reply and propose changes. Code decides: who is allowed to say what, which project phase allows it, and whether a person must decide.
It can never waive a required input on its own, change prices or deadlines, add recipients, approve a cut, or send your files to anyone new.
Instructions hidden inside emails or documents are treated as data, never as commands.
An email that fails sender authentication (SPF, DKIM or DMARC) never changes anything without studio review. Approving a final version always needs a one-time code sent to the approver.
Queued messages re-check the project right before sending, so fixed problems don't trigger stale reminders.
Every change is recorded with who or what made it.

Your data

Original footage and exports stay in your or your client's storage. We store references and what we observed (name, size, type, revision).
We process only messages sent to a project's own address or page. We never read your inbox.
Model processing uses only the text needed to interpret a reply. We never send video to a model.
Subprocessors in this release: Supabase (database & auth), Vercel (hosting), Resend (email), Anthropic (reply interpretation, when enabled), Stripe (our subscription), Google (only if you connect Drive).