Authorized data only
The scope identifies the customer-approved data and source before ingestion.
Read-only is an architectural boundary, not a sales phrase.
The verified Shadow Mode offer begins with authorized staged data, named people, source lineage, management review, and no external ERP write path.
One branch first
The verified starting offer is tenant- and branch-scoped; expansion requires a separate decision.
Externally read-only
Shadow Mode receives no authority to mutate a source ERP or take consequential action.
Source lineage
Normalized records retain the source needed to review where a claim came from.
Ambiguity quarantine
Uncertain mappings are isolated for human resolution rather than guessed.
Named reviewers
Management decisions and overrides remain attached to the named reviewer and reason.
Audit history
Material observations, recommendations, decisions, and outcomes remain reviewable.
Operational boundaries
Access, retention, incident, backup, recovery, and deletion rules are documented before work begins.
Separate production gate
Any later integration or authority requires its own security, permission, testing, customer-authorization, and commercial approval.
Security claims stay evidence-bound.
This page does not claim a certification, service-level agreement, recovery objective, data residency, or production activation that has not been separately documented and approved.
Next step
Start with the number.
Use the estimator, then decide whether a 20-minute fit and data-readiness call makes sense.