What we shipped on 3 November 2026

How we counted: the list items under 3 Nov 2026 in the changelog, 26 in the morning and 42 in the afternoon. Every item below is one of them, shortened, with a link to the live page where it can be tried or checked. Numbers are as of that day.

AI you can verify10

The desk review and Ask Kolaboro, with tests and quotes you can check.

• Two AI models read every page: on the fields a buyer acts on they must agree, otherwise the buyer is told what to check by hand. Agreement in the evaluation: 131 of 136 critical fields.
• The AI evaluation reruns whenever the desk review's code, prompts or test pages change; the history shows every run, including failed ones.
• Broken model output is repaired or handed to the second model, instead of failing.
• Protection against manipulated websites: hidden text removed, page fenced as data, instructions aimed at AI detected in eight languages and shown to the buyer as a warning.
• Daily AI evaluation: 17 fictional test pages, 8 of them manipulation attempts. First run: 17 of 17 cases, 64 of 64 checks.
• Not a property project: the desk review now says so clearly (for example for a news site) instead of scoring it.
• Check a project shows each real server step live with its measured time; the signed result can be checked in your browser.
• Every AI claim carries an exact quote from the page; claims without one are removed. 18 of 18 cases, 108 of 108 checks; 124 quotes checked, 1 removed.
• Try to fool our AI: paste hidden text and see if the verdict changes. Our own first attempt found a nested hidden text bypass; fixed and added to the evaluation.
• Ask Kolaboro: answers only from our own pages and data, every sentence quotes its source and is checked. 10 of 10 tests passed.

Open data and APIs7

The same data we use, for anyone to query.

• SQL in your browser: every project and market as two signed Parquet files rebuilt daily, queried with DuckDB on your device.
• Public MCP server at kolaboro.com/mcp: any AI agent can read every tracked project and market; every answer is signed.
• Time travel: /api/open/projects/{id}/at/{day} returns a project as published on a past day, checked against the public log.
• Prices: advertised prices against 100,130 registered sales (Dubai Land Department, HM Land Registry, Irish Property Price Register). Dubai +31%, London +11%.
• Register checks: every official register tested for machine checks, with live lookups on Companies House and the Australian Business Register. 16 UK projects checked, 1 named company dissolved.
• State of Off-Plan, live: every chart computed in your browser from the Parquet file, with its code, SQL and a signed fingerprint.
• Self-serve API keys with a daily quota and usage panel; only the key's hash is stored. The open API still needs no key. opens after setup

Buyer tools11

Free tools that run in your browser.

• All free buyer tools on one page.
• PDF check: every save inside a contract PDF, what it changed and whether the signatures still cover the file. Not uploaded.
• Image check: compares a render or photo with 7,963 images of 794 tracked projects. The image never leaves your device.
• Account check: IBAN, CLABE, ABA and SWIFT numbers checked in your browser, with a warning when money would leave the developer's country.
• Ctrl+K search over all 891 projects in your browser, even offline, in 0.4 to 10.7 ms.
• What would change this score: each project page recomputes the Trust Score in your browser. It matches the published score for 891 of 891 projects.
• Milestone payments: hold each instalment against signed photos, the project record and the satellite, as evidence found, not found or unknown.
• Browser extension: Kolaboro's record on 26 property portals (190 projects matchable by address, 771 by name). The page address stays in your browser.
• Encrypted deal room: notes, checklist and files encrypted in your browser, each entry signed and chained. The server side opens after setup. opens after setup
• Forward to our Telegram bot a developer's message, brochure or link and get the desk review back. opens after setup
• Push alerts when a watched project's record changes. opens after setup

Developer intelligence5

What developers claim, compared with public records over time.

• Copied-render detector, weekly: 8,226 images from 797 projects, 0 cross-project reuses after removing portals, maps and same-developer pairs.
• Real website age (RDAP and certificate logs) next to the founding year claimed: 16 projects have a website at least 3 years younger than their claimed history.
• Promise drift: daily copies of developers' pages. 821 projects have copies, 120 changed, 297 changes over 6 days of history so far.
• Risk patterns: an explainable model over 891 projects shows which look unusual on public warning signs, and why. It does not predict fraud.
• Right of reply: developers prove their domain by DNS, attach fingerprinted documents, and a person reviews before publishing. Storing replies opens after setup. opens after setup

Satellite3

Progress on site, read from public archives.

• Sentinel-1 radar, which sees through clouds: all 27 watched sites have radar backscatter per period.
• Monthly Sentinel-2 progress, cloud-masked, for all 27 watched areas, with a timelapse and a year-on-year built-up or bare figure.
• Your plot: drop a pin and see one clear picture per quarter for up to 3 years, read in your browser in about 10 seconds.

Trust and security14

Ways to check us without trusting us.

• Public log as a Merkle tree with a signed checkpoint, inclusion and consistency proofs (RFC 9162); the page checks nothing changed since your last visit.
• Bitcoin timestamps checked in your browser: the OpenTimestamps proof is replayed up to the block reported by mempool.space.
• Sigstore Rekor: every daily log line is also recorded in the Linux Foundation's public transparency log.
• Founder co-signature: each daily log line can be signed again with a passkey on the founder's own device, checked in your browser.
• Phone-signed site photos: signed with a passkey on the agent's own phone; anyone can check the signature from the public receipt.
• Case-file PDFs registered with their SHA-256; anyone can check a PDF.
• Signed data checked in your browser, with a visible badge that shows the result.
• Trust center: 13 controls checked live, 12 pass and 1 warns (the ZAP scan). Mapped to SOC 2 criteria, not audited.
• Investor dossier: only measured numbers, each with source and time. No projections.
• Weekly OWASP ZAP scan. First result: 0 high-risk findings.
• Decoy credentials (a fake admin key, a fake API key and a decoy path) alert us when used.
• Subresource Integrity, a report-only script allowlist and security.txt.
• Strict content security policy on trial in report-only mode: it reports what it would block and blocks nothing yet.
• Engineering section explaining how Kolaboro is built and checked, with live numbers.

Reliability16

Checks that run on their own, every day or week.

• Weekly backup restore drill. First run: 14 tables, 3,960 rows, 5 evidence files, all matched.
• Weekly chaos drill in production (AI readers down, dead and slow pages). First run: 8 of 8.
• Safe deploys: every push smoke-tested in a real browser (32 checks) and rolled back automatically if it fails.
• Uptime probes every 5 minutes from outside Cloudflare, browser error reports with a daily digest, and every API answer names the code version.
• Second uptime vantage point: GitHub runners probe hourly and prove who they are with an OpenID Connect token, no stored password.
• Hourly buyer journey walked by a real browser, with screenshots kept.
• Data freshness objective: 90% of projects re-read within 7 days, per market. Today: 100% of 891.
• Daily cost ceiling for the site's AI: every call is costed and features switch off at the cap.
• Nightly accessibility check on 116 pages: pages with serious issues went from 22 to 5.
• 7 colour-contrast problems fixed, found by the daily accessibility check. fix
• Property tests: 54,000 generated cases per run check the scoring code; they caught 8 of 8 bugs planted on purpose. No public page yet.
• Transparency Index rounding: JavaScript and Python differed by 0.1 on 6 of 94 markets. One rounding rule now: 94 of 94 agree. Found by the property tests. fix
• Parquet progress column did not count a published 0% as public. It does now. Found by the property tests. fix
• The home page shows real activity on the site as it happens.
• Faster links: the next page is fetched ahead; median click to first paint fell from 1,701 ms to 492 ms. Try any link on this page.
• Real-user page speed (web vitals). opens after setup

Open source2

Code you can run yourself.

• Three independent verifiers in JavaScript, Python and Go, no dependencies. Every day they check the test vectors and the live log and must agree.
• TypeScript and Python SDKs that check our signature on every answer, installable from kolaboro.com with published hashes.

What is built but opens after setup

From the changelog: "the code is live but waits for a key, an account or a database step from us."

• Self-serve API keys: a database step
• Encrypted deal room: the server side
• Forward to our Telegram bot: the bot
• Push alerts: a push key and a database step
• Right of reply: storing replies
• Real-user page speed (web vitals): a database step

How to check us: Trust center, System status, Public log, Verify evidence.