Counsel Review Package — 2026 Q2

​

1. Executive summary

A line-by-line internal audit of the 24 core policies (22 in policies/, 2 in legal/) was completed on May 9, 2026. The audit identified 36 findings across four severity tiers — Critical (6), High (10), Medium (10), Low (10) — plus a network-posture rescoping (Cloudflare One = default; Tailscale = restricted to production-infrastructure access). All 36 findings have been remediated in five commits on master. 23 inline (todo: …) markers remain across the policy set; each is scoped to a question that requires counsel input, vendor selection, or organizational confirmation, and is queued for this review. The policy set as it stands has, in this author’s non-legal view, materially closed the gaps identified in the audit. The work product on which this review should focus is in §3 (Open items requiring counsel input) — the items that the audit explicitly punted to GC.

​

2. Remediation log

Total: 5 commits, 36 findings closed, ~85 files touched (some files appear in multiple tiers).

​

3. Open items requiring counsel input

The audit deliberately preserved 22 inline TODOs that turn on questions only counsel (or counsel + a business owner) can resolve. They are grouped below in roughly the order recommended for the meeting.

​

3.1 Whistleblower & escalation infrastructure

​

3.2 Trade compliance — five linked items

​

3.3 EU AI Act tiering

​

3.4 Employment / privacy — non-CA jurisdictions

​

3.5 Insider trading & FCPA recordkeeping

​

3.6 EU Cyber Resilience Act

​

3.7 Cross-border transfers, DPF, and DPIA lead supervisory authority

​

3.8 Section 14 legal-audit drafting cluster (carry-over)

The May-2026 internal legal audit produced 50 incremental drafting findings (F1–F51) tracked in Finalization Tasks → Section 14. Eight (F8, F11, F31, F35, F38 [withdrawn], F40, F41, F48) have landed; the remaining are GC-redline candidates and ride into this packet for VGC review. Counsel is asked to red-line the drafting changes proposed below, organized by theme; each cluster is intended to land as one PR after the meeting.

​

4. Cross-cutting program decisions to confirm

These are not specific TODOs but program-level posture items the audit assumed and that the GC should explicitly confirm or amend before the next review:

1. HIPAA descope. Memory of record: HIPAA / PHI / BAA were removed entirely on 2026-05-08; no Neuroscale product handles PHI. Confirm this is still the GC’s position and that no customer pipeline contemplates a HIPAA Covered-Entity / Business-Associate engagement.
2. GDPR Art. 37 mandatory DPO. The policy set takes the position that Art. 37 is not triggered (no public-authority status, no large-scale regular and systematic monitoring, no large-scale special-category processing) and that the GC performs DPO duties voluntarily. The DPO independence note (policies/roles-responsibilities.mdx) flags the EDPB conflict concerns; the policy commits to retaining an independent DPO if Art. 37 later triggers. Confirm.
3. Outside-counsel role for GC duties. The compensating-controls table assumes VGC LLP holds the GC role under a standing engagement letter. Confirm the engagement letter scopes the full set of GC duties used in this policy library — breach determination, DPIA sign-off, whistleblower escalation, anti-bribery investigation, trade-compliance license determinations, insider-trading pre-clearance, etc.
4. Network posture. Cloudflare One is the default VPN/ZTNA layer for all staff; Tailscale is restricted to production-access roles (Engineering On-call, System Owners). The Cloudflare relationship is being treated as a sub-processor of workforce data only (no Customer Personal Data flows through Cloudflare One in normal operation). Confirm that posture is consistent with the executed Cloudflare DPA.
5. Public-company readiness. The policy library now contains forward-looking sections for Section 16, Reg FD, Reg G, Form 8-K Item 1.05, and Reg S-K Item 106. None applies today. Confirm the appropriate trigger event (Form S-1 filing? Section 12 registration? Specific runway date?) at which counsel will activate those sections.
6. Privilege framework for incidents. policies/incident-response.mdx now requires a written engagement memo at the start of any P0/P1 incident with potential legal exposure, with forensic vendors retained through outside counsel. Confirm the standing engagement letter contemplates this and that VGC LLP (or designee) is on call for P0/P1 incidents.

​

5. Suggested agenda for the meeting

1. (15 min) Open items in §3.1 — whistleblower / Audit Committee / hotline vendor. These have the highest “auditor-visible” cost of leaving open.
2. (20 min) Trade-compliance items in §3.2 — five linked items that benefit from being decided together. Likely needs outside trade-compliance counsel input on TC2 and TC3. Note TC1 has been resolved on the Neuroscale side (internal api.trade.gov service); confirm legal sufficiency.
3. (15 min) EU AI Act items in §3.3 and CRA in §3.6.
4. (10 min) Employment / privacy non-CA items in §3.4 — confirm the per-jurisdiction matrix VGC will maintain.
5. (10 min) Cross-border transfers (§3.7): file DPF certification and confirm transparency-report cadence; DPIA LSA defers until EU operations.
6. (20 min) §3.8 legal-audit drafting cluster — walk through F-Labor and F-Absolute first, F-DataMgmt + F-IR + F-Mechanical as time permits.
7. (10 min) Cross-cutting program decisions in §4 — items 1, 3, 5, 6 in particular.
8. (10 min) Schedule and ownership for the next quarterly review (target: August 8, 2026).

Pre-reads: this page; the rewritten Whistleblower Policy; the Trade Compliance Policy; and the AI Acceptable Use Policy.

​

6. Document control