How we handle uncertainty

We tell you what we could not establish

A compliance answer is only useful if you can tell a checked result from an unchecked one. Where an Aervik Labs API could not read, reach or verify something it was asked about, it says so in a field your code can branch on, instead of returning a clean-looking answer — and where one of our APIs does not yet do that, this page says so too.

Four methods, and where they are enforced

Aervik Evidence Standard

A number, a date or a "yes" read from your document is returned only if it can be quoted from the document. The model reading the document must give the characters it read for each value, and code — not the prompt — checks that those characters support the value. A value that fails is returned as null. COI / ACORD 25 Verification names each one in withheld; Invoice & Receipt OCR reports each one in warnings; AI Resume Parser lists each one in withheld.

What it cannot do: the check compares the value with what the model says it read, so it stops a value filled in from a neighboring cell or from what a typical form carries; it does not independently re-read the image. The COI Extraction Honesty Test shows the difference on synthetic certificates.

Aervik Non-Assertion Rule

Something that was not checked is not reported as clear. A certificate field that could not be read makes the COI verdict cannot_determine, not deficient and not compliant. In Import Risk Screening and EPA Compliance Risk, a source that failed, was not live, or returned only part of its matches sets incomplete_coverage: true with the reason. When FDA Import Alert Screening's copy of FDA's lists cannot be read, has not completed its first refresh, or comes from a refresh that began more than 7 days ago, the API answers 503 source_unavailable instead of a "no match". An absence of findings is not an absence of checking. The responses are built to tell the two apart, and the limits on this page name what each product does not check.

It also applies to what you sent us, not only to what we read. Added 2026-09-19: a company name written as a single word with no spaces — ArdAlkhair, XinjiangProduction — is a shape these matchers handle badly, because a compacted string shares no word with a listed name of several words. We measured it on 97 real listed entities: a company’s short name finds its record 98% of the time spelled with spaces and 4% without. When a query of that shape finds nothing, Import Risk Screening, FDA Import Alert Screening and EPA Compliance Risk now report incomplete coverage with the reason rather than a clean result, and tell you to re-screen the spaced legal name. We did not close the gap — every way of widening the matcher that we measured created new false matches between genuinely different companies. What we changed is that the result no longer reads as clean. The measurement and the data, and a free checker for a list you are about to screen.

Aervik Source Freshness Standard

A date of freshness comes from the source, or is null. Where a source publishes its own date, as_of carries it. Where we serve a copy we took — FDA's Import Alert pages, the U.S. tariff schedule — the date is the date of that copy, and the response says so. Where neither can be established, as_of is null and the note explains why. Our own clock is never presented as the source's date. Each product's sources, how we read them, and each source's own stated schedule are on Data Sources & Freshness, and in machine-readable form, with live health, at /sources.json.

Aervik Honesty Test

A test set built around the failure, with ground truth written down before any call. Each fixture holds one trap — a blank cell between filled ones, a placeholder value, a document that is not a certificate, a smudged cell — and requires the neighboring values to survive. The fixtures, the method, our own results and the corrections the test forced are published at /research/coi-extraction-honesty-test/, free to use against any tool.

Fields that mean a person should look

Each is part of the response contract, described in each API's documentation and, where one is published, its OpenAPI document.

API	field and value	what it means
COI Verification	`verdict: "cannot_determine"`	A value a requirement depends on could not be read. Ask for a clearer copy; it is not a coverage failure.
COI Verification	a deficiency with `status: "unreadable"`	The value is on the certificate but could not be read, or it is a policy date missing from a coverage row the certificate shows (not established). `"absent"` means it is not on the certificate.
COI Verification	`withheld` not empty	Values that could not be quoted from the document were returned as null.
AI Resume Parser	`withheld` not empty	An email, phone number or date that could not be quoted from the document was returned as null; the list names each one.
Invoice & Receipt OCR	a warning with `code: "unreadable_number"`	A number or date was printed but could not be read or quoted, or reads more than one way; its field is null and the message names it.
Invoice & Receipt OCR	a warning with `code: "totals_mismatch"`	The line items, subtotal, tax and total do not reconcile; items may be missing or an amount misread.
COI Verification	a requirement you sent missing from `evaluated`	That rule was not checked.
Import Risk, EPA	`incomplete_coverage: true`	Something this API intended to screen was not fully screened; the reasons say what.
Import Risk, FDA, EPA	`coverage_note` present, or a matching reason	The name you sent was a single word with no spaces and nothing matched. Listed names are usually several words, so this is not enough to call it a clean screen — re-screen the spaced legal name.
Import Risk, FDA	`status: "possible_match"`	A name similarity that needs a person to compare the records.
Import Risk, EPA, FDA	`source.basis` other than `"live"`	That section was not checked against the live source.
HTS Landed Cost	`confidence`, `precision_note`, `surcharge_coverage`	How sure the subheading match is, how wide the duty range is, and which additional duties were not assessed.
SEC Form 4	`narrative_status: "degraded"`	At least one context note was not written by the model; the transactions themselves are unaffected.
PII Redaction	`warnings` or `unlocated_count` present	A value was found but not redacted; it may still be in `redacted_text`.

Where AI is used

Models read uploaded documents, detect personal data in text, suggest a tariff subheading, and draft plain-English notes. Reference data — lists, schedules, filings, enforcement records — comes from the issuing agency, not from a model, and any number that has to be reliable, such as a verdict or a duty range, is computed by fixed rules. Which products send request content to our model provider, checked against each product's deployed configuration, is listed on Security & Data Handling, which also covers what we store (submitted documents are not stored; COI requirement profiles you choose to save are stored for reuse), logging, encryption and authentication.

Limits we state rather than hide

Every result is advisory. None is legal, insurance, customs or investment advice.
Import Risk Screening screens organizations: records about individual people are withheld, and the scope says so.
COI Verification reads what a certificate prints: it does not detect a forged or altered certificate, and it does not compare the named insured with the party you contracted with.
FDA Import Alert Screening compares firm names; it does not match on an address or an FEI number. Import Alerts that detain a product from a whole country unless the firm is on the alert's Green List are not assessed: a firm can be covered without being named, and every result says so. Names are compared after removing punctuation, accents, letter case and common legal forms such as Ltd and Limited; a name written differently in other ways, such as a translated name, can score below the match threshold and come back no_match.
PII Redaction can report only what its model found. A value the model misses stays in the text with no warning, so a response without warnings is not proof the text is clean.
There is no uptime guarantee or SLA; the Terms say so. Each API has a public /health endpoint, and /sources.json reports them together.

Research and benchmarks

Published research states its method, its limits and the date of every measurement, and ships the data: the COI Extraction Honesty Test, SEC Form 4, 2026 Q2, and the data behind Is the 6-Digit HS Code Enough?. No competitor is tested or named. Research data is licensed CC BY 4.0; specs, Postman collections and code examples are MIT (Developers).

Corrections and security reports

When we get something wrong we fix it and say so with the date: see About for how to report an error, and the changelog (Atom feed) for dated corrections. Security and privacy concerns go to the contact on Security & Data Handling, also published at /.well-known/security.txt. EAC Ventures, LLC is accountable.