Progress Report — August 2026 (Baseline)
Period: Inception to 2026-08-02 Filed: 2026-08-02 Prepared by: Fikret Güney Ersezer For: Cube Incubation
This is a baseline rather than a progress report. Its job is to establish the starting line honestly, so that every later report has something real to measure against.
Executive summary
Section titled “Executive summary”Demostatics has a substantial working codebase and no product. Four repositories contain a functioning web application with a forum, a JSON API, a Rust desktop analytics client and a React Native phone client — but the tier that produces the data those clients exist to display has never been written, so the platform has nothing to show and nothing to sell.
Two decisions define this period. First, the company will operate as an investment company across four lines — data and intelligence, investment advisory, discretionary management, and proprietary trading — rather than as a data product alone. Second, a full audit of the project was completed, producing a documented gap register of 86 findings and a sequenced plan.
The audit’s most important finding is not a defect. It is that the data history clock has not started. Nothing is being collected from any source, and every month of not collecting is a permanently missing month of the backtestable history institutional buyers ask for first. It is the only item in the register that gets worse with time and cannot be recovered by any later decision.
Immediate priorities are to start collecting data, resolve a cost question where two readings of the plan differ by roughly a hundredfold, and begin the regulatory licensing path, which has the longest lead time of anything in the business.
Status at a glance
Section titled “Status at a glance”| Metric | Value | Note |
|---|---|---|
| Days of data history | 0 | Nothing is being collected from any source |
| Data sources live | 0 | Nine declared, none integrated |
| Observations collected | 0 | The 19 rows in the product tables are local seed data |
| Deployment | None | Nothing is running anywhere |
| Registered users | 0 | No deployment, therefore no users |
| Revenue | 0 | No billing mechanism exists in any repository |
| Roadmap phase | Pre-Phase 0 | Phase 0 is deployability, not started |
| Licensing stage | Not started | No counsel engaged, no jurisdiction decided |
| Open gaps (existential / high) | 5 / 42 | From the 86-finding audit |
| Monthly spend | <TBD> | No cloud infrastructure provisioned yet |
| Runway | <TBD> |
Every zero above is accurate and expected for the stage. The purpose of recording them is that the first non-zero value in the top three rows is the most meaningful progress signal this company can produce.
What exists today
Section titled “What exists today”Reporting honestly means being clear that “no product” does not mean “no work.”
| Component | State | What works |
|---|---|---|
| Web application (Laravel) | Shipped | Forum with threaded comments and communities, polls with voting, accounts with email verification, role-based moderation and bans, editorial content, filterable report and database listings with export to Excel/Word/CSV/JSON, and a 45-endpoint JSON API. 211 tests passing |
| Desktop client (Rust) | Shipped, against a mock server | A dockable analytics workspace: live charts with downsampling, curve fitting, descriptive statistics, correlation matrices, a composite risk score, threshold alerts with OS notifications, offline cache, hardware-profiled render quality, command palette, streaming AI assistant. Cross-platform CI and a tagged release pipeline |
| Mobile client (Expo) | Shipped | Five tabs against the real API — news, forum, polls, data, profile — with a full auth stack |
| Worker tier | Not built | The data-gathering and processing backend. One README, no code |
| Documentation | Shipped | 43-page technical and business knowledge base, this site. Every factual claim verified against the code |
The engineering quality is above stage norms in specific, checkable ways: no unsafe code in the Rust workspace, dependency licence and advisory scanning in CI, statistically correct implementations (Welford variance, Bessel correction, two-pass Pearson), every database migration reversible, and a documentation set whose factual claims were verified against the code.
What changed this period
Section titled “What changed this period”The business model was decided. Demostatics will be an investment company operating four lines rather than a data vendor. This is a material change: three of the four lines are regulated activities that cannot begin without a licence, and licensing became the longest-lead-time item in the plan. It is documented at Business Model and Regulatory Posture.
A full project audit was completed. A five-lens sweep — security, legal and privacy, operations, commercial, and engineering and AI governance — searched for absences rather than defects. It produced 86 findings, of which five are classed existential, and roughly fifty things the project already does well. The full register is at Gap Register.
Three findings changed the plan itself. The history clock, described above. A cost model whose two plausible readings differ by roughly a hundredfold per month — one affordable by a single founder, the other requiring institutional capital before producing a single row of data. And the realisation that licensing is a capital requirement as well as a time one: authorised firms hold minimum regulatory capital, and a compliance officer, custodian, auditor and professional indemnity insurance sit behind it. None of that had been costed.
A live credential was found and is being rotated. A Google Gemini API key had been hardcoded in two console commands in the web repository. The files were later deleted, but the key survives in 20 reachable revisions of a private repository. It is being revoked and secret scanning is being added to CI.
Three live infrastructure problems were found during measurement, none previously known:
demostatics.comserves an invalid TLS certificate. The certificate presented is*.srvpanel.com, the hosting panel’s default, not one issued for the domain. Every visitor gets a browser security warning before seeing the “coming soon” page. Roughly thirty minutes to fix and worth doing before anyone from the incubator or a prospective customer visits.docs.demostatics.comdoes not resolve. No DNS record exists. The documentation site is configured to publish there and has no host yet.- Continuous integration has been failing since 2026-07-29. Six consecutive runs on the
Rust repository failed, every job in five to twelve seconds with zero steps executed —
meaning the runner never started rather than any test failing. The repository is private,
and the workflow runs macOS and Windows runners (billed at ten times and twice the Linux
rate) on every push to
main. The pattern is consistent with exhausted GitHub Actions minutes. Confirming it needs billing access.
Accepted into Cube Incubation. Which is why this document exists.
Financials
Section titled “Financials”| Spend to date | <TBD> |
| Monthly burn | <TBD> |
| Runway | <TBD> |
| External funding | None |
| Revenue | None |
No cloud infrastructure has been provisioned, so recurring infrastructure cost is currently zero. That changes the moment data collection starts, which is the immediate priority.
The cost analysis at Cost and Funding sets out two scenarios for running the platform, estimated at roughly $500–5,000 per month on free and open data sources, versus roughly $50,000–250,000 per month if the founding document’s source list is taken literally. Both are estimates with the reasoning shown, and resolving which one applies is a priority this month.
Risks and blockers
Section titled “Risks and blockers”1. The history clock. Every month without collection is permanently lost backtestable history, and it is the first thing an institutional buyer asks about. Mitigation: start a raw archive immediately — one scheduled fetch writing to object storage under a dated key. No worker, schema or parsing required. This is days of work, not weeks.
2. Unknown cost structure. The plan cannot be architected without knowing which of two hundredfold-different cost scenarios applies. Mitigation: obtain real quotes for the top three cost drivers this month, and default to the free-source path documented at Minimum Viable Data Set unless a paid source proves necessary.
3. Licensing not started, and it gates three of four business lines. It requires capital as well as time, and neither has been quantified. Mitigation: engage counsel on jurisdiction and entity structure this month. It runs in parallel with engineering and blocks nothing in line 1.
Two further risks worth recording: bus factor is one across four languages and five repositories, with no credential inventory or handover; and the data sources named in the founding document may not be licensable for a business that stores and resells derived data, which is a different permission from calling an API.
The full register is at Risk Register.
Specific and small, in priority order.
1. An introduction to capital markets counsel. The single highest-value thing Cube can provide. Licensing is the longest lead time in the business and the questions are documented and ready at Regulatory Posture — counsel would receive a structured brief rather than a blank page.
2. Cloud credits. Any AWS, Google Cloud or Azure credit programme available through the incubator directly funds the raw data archive, which is the most time-critical item in the plan. Even a small allocation starts the history clock immediately.
3. Introductions to potential design partners among Turkish financial institutions, research bodies or policy teams — the four buyer segments the product targets. One conversation with a real prospective buyer would test the positioning better than any further internal analysis.
4. Anyone who has procured alternative data. Someone who has bought this category before would compress the pricing and licensing questions from months to a conversation.
5. A second engineer. Bus factor is one across four languages. Not urgent this month, but worth flagging early.
Next period
Section titled “Next period”Committed, and checkable in the next report.
- Revoke the exposed API key and add secret scanning to CI in all repositories.
- Start the raw data archive. At least three sources collecting daily. The next report should show a non-zero days-of-history figure.
- Obtain real cost quotes for the top three drivers and publish a one-page financial model with burn and runway.
- Engage counsel on jurisdiction and entity structure.
- Resolve the 28 dependency advisories in the web repository and add CI to the two repositories that have none.
- Fix the TLS certificate on
demostatics.comand get CI running again.
- Metrics — where each number above comes from
- Report Template — the format for subsequent reports
- What To Do Next — the plan these commitments come from