The error you transcribe yourself is the one you'll defend at the border

Manual capture is retyping a supplier's certificate details into a master sheet — and it is the moment errors are born. Every hop between formats is a small chance of introducing the exact mistake you're being paid to prevent.

Daviah pushes capture back to the source of truth. Producers submit their own data through a supplier portal as agents, not respondents — they maintain it, the buyer's team just consumes it, always current. Uploads are mapped once into a fixed canonical schema (AI-proposed, human-approved), duplicate re-uploads are a no-op (content-hashed), and Daviah ingests other platforms' exports (Fairtrade Plot Insights, Sourcemap) so nothing gets retyped that already exists somewhere.

The schema is deliberately stingy — it asks only for fields with defensibility value, and it refuses to let an import write onto attestation fields (facts, not attestations), because every field captured is a field someone must defend for years.

Well-formed data isn't the same as defensible data

This is where compliance raises the stakes on a familiar principle. A bad address is an annoyance; a VAT number that doesn't match its country, on a shipment the regulator pulls, is a finding.

Validation in Daviah happens in layers. Deterministic checks enforce VAT / DUNS / LEI / EORI formats and ISO-2 / enum membership — reference tables and dropdowns in code. Placeholders like "N/A," "TBD," "asdf" are flagged, never trusted. Malformed payloads are rejected before any handler runs. Personal data is redacted, encrypted, and blocked unless a GDPR lawful basis is recorded.

And then the deepest validation of all: Daviah's claim-defense gate — roughly 48 rules across five frameworks (EUDR, UFLPA, CSDDD, LkSG, FLR), each citing the paragraph of the regulation it enforces — validates not the field but the claim itself. Would this hold up? If not, the gate refuses to let it ship.

Ten thousand PDFs cannot answer one relational question

Daviah stores structure, not files. Not Certificate.pdf, but type, issued by, issue date, expiration date, supplier, region, status — plus the field that actually makes it defensible: coverage scope. Which facility does this certificate actually cover? A cert for the parent org cannot defend a claim about a different producing site, and only structured storage lets Daviah's gate catch that distinction.

Third-party deforestation screening isn't a saved screening.pdf either. In Daviah it's a structured, immutable report — screening version, per-commodity risk class, eleven named indicators, plot area, centroid. Structure is what lets the system reason about the data at all, and reasoning is what turns a folder into an answer.

Enforcement questions are always relational

A supplier owns a farm. The farm ships a product. The product is contained in a shipment. The shipment is approved by a reviewer. The approval is used in a claim. That's not metadata — that's the entire story of whether the claim is true.

Daviah's data model is a graph — because the questions are graph questions. Scope entities own geolocated plots. Plots feed lots. Lots move through custody events into shipments. A case relates them under a claim. A two-person signoff approves it.

The relationships are where defensibility lives: Daviah's gate checks that every lot in a shipment traces to a geolocated plot; that the certificate's coverage relates to the producing facility, not the parent org; that one case can carry CSDDD and EUDR at their respective in-force versions simultaneously, because the same data has to answer to multiple regulations at once. A record says what something is. A relationship says whether the claim about it is true.

Data decays in two directions at once

This is the stage everyone underfunds. In compliance, data doesn't just drift — it decays in two directions at once: your evidence ages, and the law moves under it. A defensible dataset has to maintain both.

On the evidence side, Daviah tracks decay directly: certificates carry hard expiry dates and operator-set re-verification cadences, so when a piece of evidence decays, the claim resting on it is flagged as exactly that — a claim resting on data that has aged past it — and the gate turns it back into a blocker.

On the law side, Daviah watches the regulations for you: it fingerprints official sources (EUR-Lex, OECD, US govinfo, Germany's BAFA) on a weekly cadence, detects amendments — including EUR-Lex consolidated-version tracking that catches a regulation being quietly superseded — and flags where a company's configuration no longer matches the current law, with deadlines. And because every decision is pinned to the framework version in force when it was made, the law changing doesn't silently invalidate history — old decisions still defend against the rule as it stood.

A "98.7%" reading on 70% data is theater

A confident-looking number can be worse than no number at all, because it forecloses the question. If the data underneath is 70% complete, "98.7%" is theater — a decimal place that means nothing sold as certainty.

Daviah's answer isn't a prettier interface. It's a status re-computed against the gate every time it's read, zeroes shown deliberately (a zero is information), and every green cell earned against the rules, not against a checklist.

Daviah uses AI only where the principle prescribes — amplifying clean, structured, validated data (mapping messy imports, comparing configuration against amended law) — always on data that was validated first, always with a human approving the output. AI on dirty compliance data just produces indefensible conclusions faster.

In compliance, the party depending on your export format is a regulator

Daviah's primary export isn't an ad-hoc spreadsheet. It's a regulator-grade dossier that reconstructs the full chain — evidence → observation → assessment → decision → signoff → statement — and, for EUDR, generates the actual EU TRACES submission payload against a published external schema.

That's the stablest contract there is: someone else's format, versioned deliberately.

Sharing in Daviah is gated. Two-person signoff before anything leaves. Export refused if the audit chain is corrupt or the signoff has gone stale. Classification-aware redaction that preserves IDs and hashes, so an auditor can grep every redaction the system performed.

And on the producer side, sharing means portability: a producer publishes a Trace by Daviah profile they own to any buyer, not locked inside one certifier's rails.

An archive you can quietly rewrite isn't evidence

Daviah archives to survive an audit years later, not to save disk. Every mutation is written to a hash-chained audit log, immutable in the database via a trigger that rejects any UPDATE or DELETE, with 7-year retention and per-tenant policy.

Delisted sanctions parties are marked, never deleted. Cold third-party reports tier to durable storage without being lost. The past is not editable — and that's exactly the point.

Ownership is portability, not storage location

Two questions decide whether a platform actually gives its customers ownership: can I export everything, with the relationships intact? and do I actually control this, or do I just store it here?

Daviah governs access with fine-grained permissions (own / business-unit / global), grants revocable, every change logged. A tenant can export their data, control who sees it, revoke a supplier's grant, and — when a contract ends — purge everything, anonymizing only the audit log the law requires kept.

And Daviah's exports carry the graph and the provenance, not just rows — so another system could reconstruct not just the records but the relationships that make them mean something.

"Prove this is true" is a lineage request

Every record in Daviah carries a lineage trail: imported from CSV → validated → reviewed by Sarah → approved → included in Report #412 → submitted to regulator. Imported data is stamped so it can never masquerade as system-produced. Every claim-defense verdict is snapshotted with a hash that links back into the audit chain.

Lineage is what turns "trust me, it's compliant" into "here is where this number came from, who touched it, and against which version of the rule it was checked."