Risk Register

This is not a list of what is missing — that is the Gap Register. This is a list of what could kill the company, how likely each one actually is, and the smallest action that makes each one smaller.

Nothing is deployed, there are no users and there is no revenue, so nothing on this page is currently on fire. Every entry is a statement about the difference between fixing something now and fixing it later. For most of them that difference is a few hours of work versus a rewrite. For exactly one of them — the history clock — later is not available at any price.

How to read the table

Likelihood and impact are Low, Medium or High. An arrow (Low → High) means the rating moves when the trigger named in that risk’s section fires; the left-hand value is today’s, with nothing running.

Likelihood is the chance the risk materialises on the current path, not the chance that the underlying condition exists — the conditions all exist today, that is why they are here. Impact is the damage if it does materialise, not the cost of preventing it.

The Owner column is not delegation. One person owns everything. It exists to separate the items the founder can close alone from the ones that need an outsider — counsel, an insurer, an accountant — because those have lead times and the others do not.

Every money figure on this page is an estimate

No repository, document or spreadsheet in this project contains a monetary figure of any kind. Every number below that carries a currency sign is an estimate, labelled as one, with its reasoning shown. None of them is a quote. See Cost and Funding.

Summary

Risk	Likelihood	Impact	Cheapest mitigation	Owner
1. The cost base is unknown, and two readings of it differ ~100x	High	High	Write down the minimum viable data set, then get three real quotes	Founder
2. Licensing needs capital, not only time	High	High	One counsel call scoped to “what cash must be held, per activity”	Counsel
3. The history clock has not started	High — occurring	High	A cron job archiving free sources to object storage, this week	Founder
4. Four business lines, one engineer, one of them can pay	High	High	Write the funding sequence: which line pays for which, and when	Founder
5. There is no path from a stranger to a paid invoice	High	High	Confirm the payment rail before the entitlement schema is designed	Founder
6. A wrong number reaches a client, a trade or a subscriber	Low → High	High	Put bounds and revision checks in the ingest spec before the endpoint	Founder
7. The sources cannot be licensed for what the model does with them	High	Medium	Read the terms of the three named mapping providers before writing an adapter	Founder + counsel
8. A supplier reprices and the margin goes with it	Medium	Medium	One adapter seam per data layer, two named sources, one of them free	Founder
9. The product is not differentiated	Medium	High	One week of desk research, then name one narrow wedge	Founder
10. Everything lives on one laptop and in one head	Medium	High	A nightly encrypted dump off-machine and a one-page credential inventory	Founder
11. The dataset walks out and nothing records it	Low → High	High	A rate limiter and a per-account read counter before the tables hold value	Founder
12. Insider risk, sharpened by trading on data the firm sells	Low	High	Append-only observations carrying a writer identity, decided in Phase 2	Founder
13. A conduct breach through the forum, the docs or the site	Low → High	High	Add “who may publish what, from when” to the counsel checklist	Counsel
14. Nobody owns the code on paper	Medium	Medium	Two short assignments signed now, plus one line edited in composer.json	Founder + counsel

Nothing on this page is legal advice

Risks 2, 7, 13 and 14 touch licensing, data rights and company law. The jurisdiction is undecided, no entity exists, and no counsel has been engaged. Every legal conclusion in this register is a question to put to a qualified lawyer, not an answer. See Regulatory Posture.

The risks

1. The cost base is unknown, and two readings of it differ by about 100x

No document, config file or comment in any of the five repositories attaches a cost to anything. That would be ordinary at this stage except for one thing: the declared source list in Data Pipeline supports two readings that describe two different companies.

ESTIMATE, with reasoning. Read as free and open sources at modest scale — an ingest VM, a managed database, object storage, free Copernicus and Landsat imagery, a small model doing classification — the pipeline runs at roughly $500 to $5,000 per month, and the biggest swing factor is model choice. Read literally as the founding document writes it — Google Maps plus Yandex plus Baidu plus a social firehose plus commercial satellite tasking plus continuous frontier-model inference at worldwide scale — sampling a thousand traffic corridors every fifteen minutes alone is millions of routing calls a month, and the total lands at roughly $50,000 to $250,000 per month. Neither figure is a quote. The gap between them is the entire strategic question and nobody has noticed it exists.

If it materialises, it looks like this: an integration gets built against the expensive reading, the first bill arrives, and the pipeline has to be re-architected around sources that were chosen for reasons the budget cannot support. The quieter version is worse — an investor or a customer asks what it costs to produce one report and there is no answer, which reads as not understanding your own product.

Cheapest reduction: The Minimum Viable Data Set written down as a page, then three real price quotes against it. Days, not weeks, and it converts the question from strategic to arithmetic.

2. Licensing needs capital, not only time

Every document in this project treats licensing as elapsed months. Regulatory Posture calls it “months to years, and no amount of engineering shortens it”, and the Roadmap says the binding constraint is a regulator’s clock. All true, and all only half the picture.

Investment-firm authorisations generally carry minimum capital requirements as well as lead times — money that must be held and maintained, not spent. The specific thresholds, and whether they apply at all, are for counsel in whichever jurisdiction is chosen; the structural point does not depend on the answer. Line 3 cannot be started with zero capital however long you wait. Line 4 is not a revenue line at all: proprietary trading consumes capital and produces volatile returns, and no document anywhere says where the firm’s own book money comes from. A compliance officer is a salary. Line 3 additionally implies a custodian, an administrator, an auditor and professional indemnity cover, none of which is free and none of which is named anywhere.

If it materialises: the founder reaches the end of the engineering plan having spent personal runway, and discovers the licensing path has a price tag he cannot pay and cannot raise against — the pitch deck has ten slides, no ask, no financials, no traction and no team.

Cheapest reduction: one scoped call with counsel that asks only “for each of lines 2, 3 and 4, what must the firm hold in cash and what must it pay annually”. Written down, that number either makes the four-line plan real or reorders it. Right now it is an unknown sitting under a decision that has already been made.

3. The history clock has not started

Nothing is being collected or archived anywhere today, from any source. The only rows in the system are 12 seeded reports and 7 seeded database items. The schema gap — no numeric time series, no provenance — is a migration that can be written any time. This is not that. This is an asset that can only be accumulated in real time.

The named buyer segments are investors, analysts and risk professionals. They buy data on one question above all others: give me the history so I can backtest it. A quantitative buyer typically needs years of point-in-time history before a signal is even evaluable. Some of what is not being collected today can be bought back later at a cost — the Sentinel-2 archive, GDELT back to 2015, Common Crawl. Some cannot be reconstructed at any price: real-time traffic, most social media, most local news.

If it materialises — and it is materialising now — it looks like this: in 2028 the platform is finished and has three months of history. The first serious buyer asks for five years, is told three months, and does not buy. That outcome is fully determined today by inaction and is not recoverable by any later engineering decision.

Cheapest reduction: a dumb archiver. A scheduled job that writes free-source files — GDELT, Sentinel-2 scene metadata, AIS, ADS-B, a handful of World Bank and IMF series — into object storage with a timestamp and a source tag, with no processing at all. ESTIMATE: under $100 per month at current object-storage pricing for the first year, based on raw file volume rather than a quote. It needs none of Phase 1’s contract work, none of the worker tier and none of the provenance schema, because it writes files rather than rows.

The only risk here that gets worse while you read it

Every other entry in this register costs the same to fix in six months as it does today, or close to it. This one is different: each month of not collecting is a permanently missing month of the asset the business is actually selling, and no later decision recovers it.

4. Four business lines, one engineer, and only one of them can pay

The founder decision of 2026-08-01 committed the firm to four lines at once. Only line 1 has code. Working the revenue timing through: lines 2 and 3 wait on a licence measured in months to years; line 3 additionally waits on a custodian, an administrator, an auditor and — for institutional allocators — a multi-year audited track record, so realistic third-party capital is at minimum three-plus years out even after a licence lands; line 4 consumes capital rather than producing recurring revenue and cannot be sold to anyone.

So for at least the next three years, 100% of realistic recurring revenue comes from line 1 — the line with no price, no billing, no ingestion and no customer. Meanwhile the same decision added regulatory burden, conflict-of-interest engineering, record-keeping obligations and capital requirements on top of it.

If it materialises it does not look like failure. It looks like progress on four fronts: some licensing reading, some conflict-prevention design, some money-layer thinking, some platform work — and at the end of a year, six half-built subsystems and still zero rows of real data. That is the failure mode the Roadmap already warns about, applied to the business rather than the code.

Cheapest reduction: a written funding sequence. One paragraph stating that line 1 funds everything for years, alone, and that lines 2 to 4 are a counsel checklist and nothing else until it does. That is not a retreat from the four-line strategy; it is the order the strategy has to run in. What To Do Next sequences it.

5. There is no path from a stranger to a paid invoice

Nothing in the platform can take money: no billing code, no plans or subscriptions or invoices tables, no payment provider, no tax handling, no currency decision. And nothing brings anyone to the point of wanting to. routes/web.php redirects the root URL to /news/about-us, so a prospect who types the domain lands on a paginated list of editorial articles. There is no page anywhere saying what the product does, who it is for or what it costs. The contact page instructs the reader to email from a business address and states that “Personal email addresses (such as Gmail, Yahoo, etc.) will not be accepted”, then promises to send a phone number and address only after verification — a screening mechanism pointed at a funnel with no volume to screen. Nothing is measured: no analytics of any kind in any view.

There is also a specific and checkable trap. The Roadmap lists “Stripe account” as routine Phase 0 setup, and the gap hunt reports that Stripe does not support businesses incorporated in Türkiye — the only address in any project document is in Gebze, Kocaeli. Verify that against Stripe’s current supported-country list before scoping Phase 3, because the alternatives (a merchant of record such as Paddle, a domestic PSP such as iyzico, or incorporating abroad) have materially different economics and different webhook models to design entitlements against.

If it materialises: the paywall ships in month twelve and nobody arrives at it, or the billing integration is rewritten after the entitlement system was designed around the wrong rail.

Cheapest reduction: confirm the payment rail before designing entitlements — an afternoon of reading — and put up one honest landing page with analytics on it. Both are cheap now and expensive at the moment runway is shortest.

6. A wrong number reaches a client, a trade or a subscriber

There is no validation, no reconciliation against a second source, no outlier or bounds check, no revision-versus-previous comparison and no data-quality alarm anywhere in the platform. App\Models\DatabaseItem has $fillable and a date cast and nothing else. There is no ingest route to validate at, because ingestion does not exist yet.

The sharp detail is the column type: database_items.value is a string holding a display string such as 48,210 MW. A decimal-place error, a unit swap or a model hallucination is not even type-detectable. It lands in the table looking exactly like a correct value, sorts to the top of the Database page by measured_at, and is served to subscribers and to the trading desk identically. Rows are overwritten in place with no history, so afterwards you cannot show anyone what the number was at the moment a decision was made.

If it materialises: a worker misparses a feed and writes an industrial output figure an order of magnitude wrong. It is sold, advised on and traded. The first person to notice is a client or a counterparty, and the firm cannot reproduce the number, cannot show where it came from, and cannot show that any other published figure was ever checked either. Loss plus an unreconstructable file is how a licence gets pulled.

Likelihood is Low today because nothing produces numbers. The trigger that moves it to High is the first automated write into database_items.

Cheapest reduction: decide the checks before the ingest endpoint exists rather than after. A numeric value column with a separate unit, a plausible-range bound per series, a revision-versus-previous flag, and one series reconciled against an authoritative public source. Specified now this is part of the Phase 2 schema; retrofitted later it is a backfill over every observation ever published. See Model Risk and Ground Truth.

7. The sources cannot be licensed for what the business does with them

The declared model is: call an API, refine the result, store it in query-ready form, and sell access — including bulk export and an API tier for institutional partners. That is a different permission from calling the API. Storing and redistributing derived data is the part that provider terms most often restrict, and it is the part the whole business consists of.

The three named mapping providers are the specific case. Google Maps Platform terms have long restricted caching Content beyond a limited window, prohibited creating derived datasets and prohibited redistribution to third parties. Baidu generally requires a Chinese entity and an ICP filing for production use. Yandex requires a paid commercial licence and brings a Russian counterparty into the supply chain, with payment-rail and screening friction for a firm that later wants EU or US clients. These are directions and collisions, not clause citations — every one needs checking against the provider’s current terms, and the redistribution question needs counsel.

There is also nowhere to record the answer. The provenance columns planned for Phase 2 — source, method, method version, ingested-at — answer “where did this come from”. None of them answers “may we sell it”, and with four business lines the same row may be licensed for subscribers and not for the prop desk, or the reverse.

If it materialises: an integration gets built, a subscriber exports rows derived from a feed licensed for internal use only, and there is no query that can tell you which rows those were because the column does not exist.

Impact is rated Medium rather than High for one reason only: a defensible source set of free, redistributable feeds exists, so discovering this before integration costs a source swap. Discovering it after a customer holds the export costs considerably more.

Cheapest reduction: read the three sets of terms before writing an adapter, and add rights fields to the Phase 2 observation schema while it is still a design document.

8. A supplier reprices and the margin goes with it

Every layer of the described product currently rests on exactly one named provider, with no adapter interface, no source registry, no second source named for any layer, and no contract anywhere — there is not even a legal entity to sign one.

The precedent is not hypothetical. Google raised Maps Platform prices by roughly an order of magnitude in 2018 with a few months’ notice and restructured SKUs again since; X closed free API access in 2023 and repriced to thousands of dollars a month; Reddit did the same. Any of those events, applied to a Demostatics already built on the provider, moves the cost base by a multiple with no recourse.

If it materialises: the first annual enterprise contract is signed at a fixed price, a provider restructures mid-term, and the gross margin on that contract goes negative with no way to switch and no clause allowing a price change.

Likelihood is Medium — this is a multi-year exposure, not a next-quarter one — and impact is Medium if the seam exists. Both ratings assume the mitigation is cheap, which it is.

Cheapest reduction: one adapter trait per data layer, and two named sources per layer with one of them free, decided before the first integration. It costs almost nothing in a design document and a rewrite afterwards.

9. The product is not differentiated

No competitor is named anywhere in any of the five repositories or in the pitch deck. The entire market argument is one sentence: “Global demand for real-time, data-driven insight is rapidly expanding.”

The space is crowded and the incumbents’ prices anchor the conversation. APPROXIMATE list prices, all needing verification before use: Bloomberg Terminal around $32,000 per user per year; LSEG Workspace and FactSet in the $12,000-25,000 range; Recorded Future and Dataminr commonly quoted at $60,000-150,000 per year. Dataminr in particular already does what Demostatics describes — real-time event detection from worldwide news and social media, sold to investors and policy teams. Verisk Maplecroft and the EIU sell country-risk indices to exactly the “policy and strategy teams” segment. Kpler and Spire own maritime; Cirium and FlightAware own aviation. And GDELT gives away structured worldwide news events for free, which means “we aggregate worldwide news” is not a product — the refinement layer has to be the product, and it has to be demonstrably better than free.

The cautionary case is worth naming: Orbital Insight built satellite-derived economic signals for investors, raised heavily, and was sold in 2024 having failed to scale the business. “Satellites plus ML produce investable signals” has been tried and is commercially hard.

If it materialises: the first serious buyer conversation opens with “how is this different from X” and the answer is improvised.

Cheapest reduction: one week of desk research producing one page — five named competitors, their approximate prices, and one sentence saying what Demostatics does better for one narrow segment. A one-person company cannot win on breadth; the only viable entry is narrow. Worth noting the same research surfaces the opposite lesson too: MarineTraffic proves a self-serve $10-200 per month prosumer tier exists in this market, which is a far more realistic first revenue than an enterprise seat requiring procurement.

10. Everything lives on one laptop and in one head

There is no backup of anything, anywhere. No backup script, no scheduled dump, no object-storage target, no backup package in any manifest; routes/console.php schedules exactly one task and it is sanctum:prune-expired. The live database is a single database.sqlite file that is deliberately gitignored, so it exists in exactly one place. What is in it that no seeder can rebuild: user accounts and their verification state, forum posts and comments, poll votes, editorial articles, and the moderation history.

Alongside that, there is no restore procedure, no credential inventory, no second GitHub organisation owner and no record of where the domain or future signing keys live. Verified directly: 113 commits across the five repositories, 107 of them by the founder across two git identities, six by two other people. The platform is five repositories in four languages.

If it materialises: the disk fails or the laptop is lost, and every account, thread, vote and curated row is gone. The recovery point objective is not 24 hours, it is infinity. The milder and more likely version is illness or a week of unavailability, during which nobody can deploy, restore, publish a release or answer where a number came from.

Likelihood Medium — over an eighteen-month window, some combination of hardware failure, theft or a period of unavailability is a coin flip, not an outlier. Impact High because none of it is reconstructible.

Cheapest reduction: a nightly encrypted dump to object storage, and a one-page inventory of every credential and account with where it lives. Hours of work. The restore rehearsal — do it once, write down the order of operations — is the part that turns a backup into a recovery, and the platform has non-obvious steps that will otherwise be discovered under pressure: the external world geo dataset is not in any repository, and APP_KEY exists only in an untracked .env.

11. The dataset walks out of the building and nothing records it

For a company whose only product is refined data, the ability to bound extraction is the margin. Today there is no throttle on any read route — bootstrap/app.php never calls throttleApi(), and the only throttle: middleware in routes/api.php sits on register, login, password reset and verification resend. The export endpoint returns up to 5,000 rows per call in CSV, JSON, Excel or Word with no cap on how many calls and no record that an export happened. There is no usage table, no per-account meter, no watermark, and no terms of service forbidding redistribution. The Laravel application makes exactly one logging call in total, so a valid credential reading everything produces zero errors and zero alerts — indistinguishable from a happy customer.

If it materialises: one subscription becomes an unlimited licence. A buyer pays for a seat, pulls the dataset over a weekend, cancels and resells it. The firm learns from the market rather than from its own systems, and cannot say which account, from where, or when it started.

Likelihood is Low today because the tables hold 19 seeded rows and are worth nothing. The trigger is the first real data landing in them.

Cheapest reduction: a RateLimiter::for() definition and one usage table, added before the data has value. Retrofitting extraction limits onto customers who already have unbounded access is a contract renegotiation rather than a code change — and the same usage record is the only thing that makes usage-based pricing possible later. See Security and Privacy.

12. Insider risk, which this business model sharpens rather than softens

The firm has decided to trade its own book on data it produces and sells, and it is one person. That person can change database_items.value — a table with no source column, no revision history and no provenance — and will also build the side of the business that trades on it. Roles are granted only through php artisan tinker on the host, so the only trace of someone granting themselves the admin role is shell history on a machine they control. There is no credential inventory, no separation of duties, no four-eyes requirement and no CODEOWNERS file in any repository.

Likelihood of the malicious version is genuinely Low — it is the founder’s own company and his own money. That is not the risk. The risk is that there is no artefact that could establish what a value was before it changed, which means the question cannot be answered either way. A regulator’s first operational-risk question for a firm running proprietary trading alongside client business is about segregation of duties, and the only available answer today is “we trust him”. That answer does not survive a licence application, and it does not survive an institutional client’s diligence either.

If it materialises in its likely form it is not fraud at all: it is an accusation that cannot be disproved, or a laptop compromise where nobody knows which credentials to rotate.

Cheapest reduction: decide now that the Phase 2 observation table is append-only and carries a writer identity, and write the threat model that names the firm’s own engineer as one of the adversaries. Both are documents, not systems, and both are free before the schema exists.

13. A conduct breach through the forum, the docs or the marketing site

Today the firm is unlicensed and sells nothing, so there is nothing to breach — likelihood Low. The trigger that moves it to High is the first licence, or the first piece of content that reads as investment advice, whichever comes first.

Why it is plausible here specifically: this firm publishes far more than a typical pre-licence startup. There is a public forum with polls on political and security topics, an editorial article system, a public docs site, and a technical-staff.md page that commits to adapting the platform “if majority of community agree on some subject by voting system”. A public website discussing instruments is frequently treated as soliciting in every jurisdiction that can read it, and staff posts in a community forum can count as client communications subject to retention. Meanwhile the forum’s own deletion behaviour cascades: posts, comments, polls, votes and ban records are all destroyed when a user account is deleted, so the record a regulator might require is erasable by its subject.

If it materialises: an authorisation application, or a supervisory visit, turns up published opinions that predate the permission to publish them, communications that cannot be produced because they were cascade-deleted, and a methodology that the documentation says can be changed by community vote.

Cheapest reduction: add three lines to the counsel checklist in Regulatory Posture — who may publish what, from when, and what must be retained — and keep staff opinions on instruments off the forum until they come back. Zero cost, and it also decides whether forum content needs anonymisation rather than deletion, which is a schema decision that gets expensive after launch.

14. Nobody owns the code on paper

No legal entity exists, so the copyright in everything currently vests in the individuals who wrote it. There is no founder agreement, no shareholding record, no vesting schedule and no IP assignment. There are also contributors other than the founder: two commits in demostatics-web and two in demostatics-docs from one outside contributor, and — more significantly — the entire initial commit of the mobile application from a contributor whose git identity is an example.com address, generated through an AI app builder whose terms nobody has read.

The repositories also disagree about what they are. demostatics-pc_application/Cargo.toml declares LicenseRef-Proprietary. demostatics-web/composer.json still declares "license": "MIT" and "name": "laravel/laravel" — a leftover from laravel new, but it is the only licence statement the only implemented server makes, and it is the artefact a diligence process reads. The Windows installer asserts “Copyright © 2026 Demostatics. All rights reserved.” and tells every user they have accepted subscription terms that have never been written.

If it materialises: diligence flags an unassigned contribution, and the contributor is unreachable or wants consideration to sign. Or counsel reads composer.json and asks whether the core server has already been licensed away.

Likelihood Medium and impact Medium, because this is fixable with signatures — right up until it is not. Assignments signed today are routine; assignments signed after a dispute, after a financing, or after someone becomes unreachable are the expensive kind.

Cheapest reduction: two short assignment letters signed while both contributors are reachable and have no reason to refuse, one line edited in composer.json, and a LICENSE file in each repository. An afternoon.

What this register does not cover

Two categories are deliberately out of scope here and live elsewhere.

Not here	Where it lives
The full itemised list of what is missing, all 86 findings	Gap Register
Model validation, ground truth, AI governance	Model Risk
Security controls and data-protection posture in detail	Security and Privacy
Cost of goods, unit economics, funding options	Cost and Funding
Which data sources to actually start with	The Minimum Viable Data Set
The order to do all of it in	What To Do Next

Also out of scope: ordinary engineering defects. The dependency advisories, the missing second factor, the demo seeder that creates an admin account with the password password, the log file that never rotates — these are real and they are in the gap register, but none of them is a risk to the company’s existence. They are a morning of work each, and they belong on a task list rather than here.

When to re-read this

A register that is written once is a document. A register that is re-read on a trigger is a control. These are the triggers that change the ratings above.

Trigger	What it changes
The first automated write into database_items	Risk 6 goes to High. Risk 11 starts moving
The first paying customer	Risks 11 and 13 go to High; risk 5 stops being theoretical
The first real credential (SMTP, payment, broker)	Risk 10 and the secret-handling items sharpen immediately
Any counsel answer on jurisdiction	Risks 2, 7 and 13 get real numbers instead of placeholders
A second person joining in any capacity	Risk 14 must be closed before they write a line of code
Every month with no collection running	Risk 3 has already cost you a month you cannot buy back