The Rateproof Covenant

Every promise in this covenant binds the data, not just the company — because the data itself carries no way to break the promise that matters most. No name, no email, and no address is stored beside a rate; where an email is kept, it lives in a separate store with no key joining it back to a submission. A future owner, whoever it is, inherits data that cannot be de-anonymized, because the link was never built. That holds regardless of who owns the company or what they intend — it isn’t something anyone has to keep doing right.

Rateproof runs on a hosted platform, and that platform uses stored data to improve its own internal models. What that means in practice is set out in the Privacy Policy.

One promise here is conduct, not structure, and it is made deliberately: on any change of control, every subscriber (a submitter with an address on file) is notified and given sixty days to have their address deleted before the close. A deleted address transfers to no one. The rows themselves transfer either way, and they point at no person.

This does not prevent acquisition. It filters acquisition to buyers who want the institution intact — the only kind of acquisition that does not destroy the asset, because the asset is a living dataset that stays current only while submitters trust it.

Rateproof exists to return pricing intelligence to the worker who needs it. Independent professionals price in the dark because the data that would inform them is held by platforms and institutions whose incentives are not theirs. Intuit holds this data and does not hand it back. Rateproof is the party that returns it. The worker is the reason the company exists and the first party it serves. This is not a value layered on a business: the data is perishable and stays current only because workers return, and they return only if it serves them, so worker trust is the only thing that keeps the asset alive.

• You always see your own position for free. Seeing it change over time needs a token.
• Roll-up rule: if your group has fewer than 10 people, we show nothing — no numbers, no comparison. This stops anyone from being singled out in a small group.
• Contribution itself is never charged for. Nothing you have earned by contributing is ever paywalled.
• Deeper layers may be paid: the cross-market map, the adjacent-tier and global-ceiling views, analytics, alerts, and the verified-income credential. These are the climb layer, above your own cell.
• A public topline snapshot is free to everyone, submitter or not — reach and credibility, not the matrix.

The founding 20 are treated uniformly at the most generous submitter-facing promise as shipped. The founding 20 keep founding-submitter status; their own cell and trajectory free permanently (the universal floor); the full granular benchmark free permanently — scoped to the benchmark and their own trajectory, not any future distinct product (such as the verified-income credential or any marketplace or demand-side tier); and milestone updates throughout. This honors ‘early access to the benchmark’ temporally (a real head start) and substantively (the actual benchmark, not a snapshot seen a week early) without conceding free access to every future product Rateproof may build. The clause is scoped to the submitter-facing copy as shipped, which protects the promise against any later discrepancy between drafting intent and what was displayed. The founding cohort backfill email defines this promise explicitly rather than leaving it open.

• Every aggregate, export, and analysis is built only from rows that trace to no one: the dataset never holds a name, an address, or any key joining a row to a person.
• A delivery address, where a submitter chooses to leave one, is held apart from the dataset and used by Rateproof for two purposes only: sending results, and asking later whether the rates still hold. It is never sold, never joined to any aggregate or export, and is deleted on request.
• Never profile or target submitters. Rateproof installs no advertising, behavioral tracking, or analytics of its own, and no email sent by Rateproof contains tracking pixels, open-tracking, or click-tracking. Where the hosting platform introduces tracking technologies of its own, that is disclosed in the Privacy Policy.
• Never publish, license, or show any aggregate below a minimum cell size of n=10. Below the floor, no number is released, regardless of buyer or price.
• No privileged granularity. No funder ever receives any cut, aggregate, or analysis not simultaneously made available to submitters. A buyer can never know more about submitters than submitters know about themselves.
• The margin figure collected at submission — the share of your rate you keep after costs — powers your own position view and nothing else. It never enters any buyer-facing aggregate, slice, export, or analysis, in any vertical. This is a conduct commitment: the data exists, and a future operator could choose differently. The amendment rule holds the choice.
• Never sell or license individual-level data. Aggregates above the cell-size floor only.
• Never build or license a tool whose function is to price-target a submitter segment downward.
• Never take demand-side money for talent access unless that access is gated to offers at or above the relevant benchmark median — the data disciplines the buyer, it does not arm them.
• Never feed human-rate data to a buyer using it as substitution-pricing input to replace submitters.

Until three funders exist or annual funding exceeds $100,000, this line is satisfied by full disclosure of every funder. After that threshold, no single funder may exceed 40% of trailing-twelve-month revenue, and no buyer category may exceed 60%. Erosion accelerates when one demand-side relationship becomes existential; the cap prevents it.

Rateproof may be funded by institutions whose interests align with workers pricing correctly and rising — cross-border payment and contractor fintech, aligned education and credentialing bodies, and development or government institutions. (Worker-floor-gated hiring access and worker-wielded verification are revenue products, not funder categories; they appear in the access/revenue model, not here.) Funding is sponsorship and licensing of aggregate intelligence above the cell-size floor, never ownership of submitter data and never data exclusivity. Every funded artifact discloses its sponsor.

• These bright lines are published the day the first public report ships, as a linked covenant — before any institutional conversation, not after.
• The asset is perishable. A rate benchmark in a fast-repricing market goes stale within quarters without fresh contribution. Betraying submitters does not slowly tarnish the asset — it kills it. That is the covenant’s built-in enforcement, and it only arms if submitters can see what is happening, which is why the transparency note below is not optional.
• An annual transparency note names every buyer category and deal type.
• A durable legal form (public-benefit structure, mission lock, or a submitter council with veto over new buyer categories) is decided before the first signed institutional deal or any change-of-control negotiation, whichever comes first. The promise binds now; the vehicle is chosen deliberately, not rushed.
• Amendment rule: this covenant is versioned. Changes are announced and apply prospectively only. Promises in force when data was contributed are never weakened for that data. The one actor the covenant must bind, alongside any future owner, is a future version of the company publishing a quieter revision — this rule binds it.

Rateproof is built as a durable worker institution that may one day be acquired, not as a strategic dataset built to be acquired. The change-of-control clause is the test and the lock: it was written first, and writing it honestly is the evidence the lean is real. The asset remains acquirable — but only by a buyer who wants a trusted, intact institution, which is the only acquisition that does not kill the thing on close. The legal form that enforces this is dated, not yet chosen. That is the one piece deliberately left open.