Legal Notice, Privacy, Cookies & Terms

1. Corporate Information (Legal Notice)

This website is operated by KodamaSEC Labs Ltd, a private limited company registered in England & Wales.

Nature of business (SIC): 62020 – Information technology consultancy activities; 62090 – Other information technology service activities; 63990 – Other information service activities n.e.c.; 71122 – Engineering related scientific and technical consulting activities.

Company details can be independently verified on the UK Companies House register, which also lists our director publicly.

Brand name — “Labs” is being retired

The public brand is moving from “KodamaSEC Labs” to simply “KodamaSEC.” The word “Labs” is being dropped across the website to avoid any confusion about what this is — it is a software-and-mathematics research project, not a laboratory in the sense of a testing or certification body. This is a forward-looking, gradual change: you will see “KodamaSEC” on the pages and in the navigation from now on.

The registered company is unaffected until a formal change is filed. The legal entity remains KodamaSEC Labs Ltd, Company No. 16006005, and that full registered name is used unchanged wherever the law requires it — the Legal Notice above, contracts, the copyright line, and any communication with a regulator or a court. Retiring the word from the brand does not, by itself, change the company’s registered name; if and when that is formally changed at Companies House, this page will be updated and re-dated to say so.

What this project actually is

This website is under active, ongoing development and should be read as a work in progress, not a finished product. KodamaSEC Labs Ltd generates no revenue, has no clients, and does not sell any product or service — we do not want clients, and we are not seeking any. This is independent software and mathematics research, published under open-source values, funded entirely out of pocket by our director, Joel Cruz Cabrera (a Spanish national), who runs the company independently as its sole director and CEO.

Who is actually behind this, and from where. KodamaSEC is a technology and research project led by Joel Cruz Cabrera, a self-employed professional (trabajador autónomo) resident in Santa Cruz de Tenerife, Canary Islands, Spain. The UK company above is real and its details are verifiable on Companies House; the work is done from Tenerife. Both facts are stated because either one alone would be misleading — a British registration with no mention of where the operator sits, or a Canarian operator with no mention of the entity that holds the domain and the ICO registration. There is no Spanish branch (sucursal), no Spanish company and no CIF: the autónomo registration is a personal one. What that means for data protection is in section 2A; what it would take to change it is in section 7.

If that ever changes — if we take on any commercial activity, paid work, or client relationship — that decision will be announced publicly on this website, and this page will be updated and its effective date changed immediately to reflect it. Nothing here should be read as offering, soliciting, or implying commercial services today.

For visitors in Germany (Impressumspflicht, §5 DDG)

This section is also intended to satisfy the German statutory "Impressum" requirement: provider name and legal form, commercial register number, registered address, contact details, and the name of our legally authorised representative are all listed above.

• VAT ID (Umsatzsteuer-ID): not applicable — we do not sell goods or services and are not VAT-registered.
• Consumer withdrawal rights: not applicable — this is an informational research site with no e-commerce, no client work, and no consumer contracts.

2. Privacy Policy (UK GDPR · Regulation (EU) 2016/679 · LOPDGDD)

Effective date: 3 October 2026 (previous revision 7 August 2026) — this revision names the three instruments that apply in full (UK GDPR, Regulation (EU) 2016/679 and Spain’s Ley Orgánica 3/2018, LOPDGDD) instead of writing “GDPR”; states in A that the controller is UK-registered but operated from Santa Cruz de Tenerife, and what that means for which law binds it; adds D2 on transfers between Spain and the United Kingdom in both directions; and makes explicit in E that the AEPD is a competent authority over this processing and not merely an option for Spanish visitors. It withdraws nothing and adds no collection — what changed is which law we say we answer to, and it is now more law rather than less. The 5 August 2026 revision, which added the API key application described in C and D, is unchanged below.

Superseded, 5 August 2026: this revision adds the API key application described in C and D (a keyed hash of a client code we generate, and two short-lived abuse counters) and corrects the ICO paragraph below. It withdraws nothing from the 1 August 2026 version. Section 4 was revised the same day. Later the same day the application stopped asking for a name at all, so the account is now identified by a code we issue: less is collected than this revision first described, not more.

KodamaSEC Labs Ltd ("we", "us") respects your privacy. This site is informational only, with one exception that is described in full rather than buried: if you ask for an API key, we store a keyed hash of the client code we issue you, so that your keys share one allowance. The form itself asks for nothing about you — one dropdown and one checkbox.

A. Data Controller, and which law applies to it

KodamaSEC Labs Ltd (Company No. 16006005, registered office above) is the sole data controller in respect of this website. We do not share visitor data with any third party for their own purposes, and no other company acts as a joint controller.

The decisions are taken from Spain, and that changes which law applies — so it is said here rather than left to be inferred. The company is registered in England & Wales, but the person who decides the purposes and means of every processing operation described below is its sole director, Joel Cruz Cabrera, resident in Santa Cruz de Tenerife, Canary Islands, and registered in Spain as a self-employed professional (trabajador autónomo). The work is done there, on his own equipment, at his own cost.

We therefore do not treat this as a UK-only matter. This site is operated on the basis that three instruments apply at once, and we name all three in full rather than writing “GDPR” and leaving you to guess which one:

• Regulation (EU) 2016/679 — the Reglamento General de Protección de Datos (General Data Protection Regulation, GDPR), which applies to processing carried out in the context of activities in the Union.
• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (Organic Law 3/2018 of 5 December, on the Protection of Personal Data and guarantee of digital rights, LOPDGDD) — Spain’s national data protection law, which supplements the GDPR where processing is carried out from Spanish territory.
• The UK GDPR and the Data Protection Act 2018, which apply to the company as a controller established in the United Kingdom.

That is our own reading, not a regulator’s ruling, and it is deliberately the wider of the two available readings. A UK company could argue that only the UK regime binds it. We do not, because the processing is directed from a Spanish establishment in fact, and because where two readings are available the honest one for a visitor is the one that gives them more places to complain, not fewer. If a supervisory authority tells us this is wrong, we will say so here and change it.

What does not exist yet, said plainly so that nothing on this page reads as more than it is: there is no Spanish branch (sucursal), no Spanish subsidiary (S.L.), and no Spanish tax identification number (CIF) for any entity of ours — the director’s own autónomo registration is a personal one and is not a company registration. No Spanish address is named on this page and none will be until there is one to name. See section 7 for what is intended and what that would change.

ICO registration: KodamaSEC Labs Ltd is registered with the Information Commissioner's Office as a data controller, reference ZC210720 — tier 1, registered 31 July 2026, expiring 30 July 2027. Verifiable on the ICO’s own public register rather than on our word. We concluded the fee was due rather than exempt and paid it instead of arguing the point.

This paragraph said the opposite until 5 August 2026, and the correction is worth leaving visible. It read “that application is in process — we do not yet hold a confirmed registration number”, written before the registration came through on 31 July, while the compliance table further down this same page already carried the reference. It is the only error we have found on this site that ran against us: the page accused itself of not being registered when it was. Registration is a fee paid to a regulator, not an audit, an approval or an endorsement — which is why the reference is published and no ICO logo is, the regulator issuing none.

B0. The one thing that stored an identifier has been switched off

Effective 7 August 2026, the public compute API is closed and the key application form is closed with it. That form was the only part of this site that stored anything resembling a contact detail: it asked for a handle to group your keys under and stored HMAC(secret, handle). Never the handle in clear — but a stable identifier derived from a name is a stable identifier, and section 2 of this page should not describe a processing operation that no longer happens. Nothing new is stored. The paragraphs below describing that key registry are kept, marked as historical, because keys issued before that date still exist and their holders are still entitled to know what was recorded against them and to have it erased on request (section 2E). What changed is that the set stopped growing.

B. No personal data is collected from visitors browsing this site

We do not use user accounts, contact forms, comment sections, newsletters, analytics, or advertising trackers. Simply browsing this website does not have you hand over any name, email, or phone number. The data that does exist is limited to three things: automated technical logging (below), whatever you choose to send us if you email us, and — for keys issued while the public API was open, until 7 August 2026 — an API key registry that stores a keyed hash of the code we issued. Apart from email you choose to send us, none of this involves a name or an email address, and browsing this site involves none of the third at all. Every font, script, and stylesheet on this site is served from our own domain — unlike most websites, we do not load fonts from Google Fonts or any other third-party CDN, so your browser never contacts Google (or anyone else) just to render this page's typography.

Specifically, on Google Search Console and Google Tag Manager: we do not run Google Tag Manager, Google Analytics, or any similar tag-management or tracking script on this site — our Content Security Policy only allows scripts from this domain itself, which would technically block a tracking script even if one were added by mistake. We may use Google Search Console to see how Google's own crawler indexes this site; Search Console does not place any script or cookie on the site and does not process visitor data — it only reports back to us about Google's crawling activity, not about you.

C. Server & security logs

To keep the site secure, limited technical data is processed automatically on each visit: IP address, browser type, and access time. Our security and content-delivery provider, Cloudflare, Inc., processes this at the network edge as our data processor. The site runs on Cloudflare Workers; there is no separate web server of ours keeping its own access log. From the same requests Cloudflare also produces aggregate traffic and performance statistics (counts and timings, not individuals, and no cookies), and we only ever see those aggregates.

Legal basis: Article 6(1)(f) UK GDPR / EU GDPR (legitimate interest — protecting our infrastructure against abuse and denial-of-service activity). This data is not used to build visitor profiles and is retained only as long as necessary for security purposes.

D. Hosting, email & international transfers

Updated 1 October 2026: this section now names every provider in the chain, including the one that holds our inbox. (The previous version, of 2 August 2026, left that last provider unnamed.)

• Website: served by Cloudflare, Inc. (Cloudflare Workers).
• Email: mail sent to our addresses, such as contact@kodamaseclabs.com, is received by Cloudflare Email Routing (Cloudflare, Inc.) and forwarded to a Gmail mailbox provided by Google LLC. That mailbox is where we read and keep what you send us. Legal basis: Article 6(1)(f) (legitimate interest in answering you) or, for official correspondence, Article 6(1)(c). Retention: while the conversation is open and up to 24 months after it ends, unless a legal obligation or claim requires longer; ask and we delete it sooner.
• Domain: Namecheap, Inc. is our domain registrar and nothing more. We no longer use Namecheap for hosting or for email, so it does not receive your messages or your requests to this site.

This means two categories of personal data can leave the UK/EU:

• Technical request data (IP address, timestamp, browser type), processed automatically at Cloudflare's network edge, as described in Section C.
• Any email you send to our addresses, routed through Cloudflare's infrastructure to our Gmail mailbox at Google — including your email address and whatever content you choose to include.

How this is safeguarded, honestly stated rather than assumed: Cloudflare, Inc. is an active participant in the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to it (independently verified on the official dataprivacyframework.gov register) — this is the recognised adequacy mechanism for that transfer, and it now covers both the website and email, not just the website as before.

Google: Google LLC states that it has certified its adherence to the Data Privacy Framework principles (Google’s own statement). Its statement does not say whether that certification covers consumer services such as Gmail, so we do not claim it does.

A limitation we would rather state than hide: the Gmail mailbox is a standard Google account, not a business one, so there is no separate data processing agreement between us and Google for it; Google handles the message under its own privacy policy. We intend to move our mail to a business mailbox covered by a processing agreement, and this section will be updated and re-dated when we do.

Until then, if you would rather your correspondence not reach Google or US infrastructure at all, tell us in a first short message and we will agree another channel with you.

D2. Between Spain and the United Kingdom

Because the controller is registered in the United Kingdom and its director works from Spain (see A), personal data can move in both directions between the two — and the two directions do not rest on the same instrument, which is the part usually written as though they did.

• Spain (EU) to the United Kingdom. Covered by the European Commission’s adequacy decision for the UK, adopted under Article 45 of Regulation (EU) 2016/679. The 2021 decision was extended and then renewed on 19 December 2025, and the renewed decision runs to 27 December 2031 subject to a sunset clause and to the Commission’s continuing monitoring. Verified against the Commission’s own announcement, not from a summary.
• The United Kingdom to Spain (EU). Not covered by that decision. This direction rests on the UK’s own adequacy regulations, under which every EEA state is treated as adequate — a separate regime that was unaffected by the December 2025 renewal.

An earlier version of this page promised the decision would be “cited by number once there is an establishment for it to apply to”. It is cited by adoption date, legal basis and expiry above, which is better than that promise and still short of it: we have not confirmed the implementing decision’s number against the Official Journal, so we do not print one. A number we have not read is a number we could get wrong, and this is the last page on which to do that.

In practice the volume of this is close to nothing: as set out above, no visitor database exists, and what crosses is the operator’s own working access to a site he administers. It is stated because a transfer being small is not a reason to leave it undeclared.

E. Your rights, including erasure

Under Regulation (EU) 2016/679 (GDPR), the Ley Orgánica 3/2018 (LOPDGDD) and the UK GDPR you have the right to access, rectify, or erase personal data concerning you, to object to or restrict its processing, to data portability, and not to be subject to a decision based solely on automated processing. This includes the right to have any email you sent us, and any short-lived technical log entry referencing you, permanently deleted. As we hold no visitor personal data beyond short-lived security logs, most requests will return no data — but where we do hold something, we commit to actioning a deletion request within 30 days and confirming it back to you in writing. To exercise any of these rights, email oficial@kodamaseclabs.com, in English or in Spanish.

The LOPDGDD adds rights the GDPR does not spell out, and they are listed rather than covered by a general reference: the digital rights in its Title X, including the right to internet neutrality, to digital security, to rectification and updating on the internet, and — the one people ask about — the right to erasure of search-engine results referring to you (derecho al olvido, article 93; article 94 covers social networks). We are not a search engine and index nothing about anybody, so in our case those mostly resolve to “there is nothing to erase”. That is an answer, not a dismissal, and if you ask we will say it to you in writing.

Two supervisory authorities, and you may choose either. You may lodge a complaint with the UK authority, the Information Commissioner’s Office (ICO), at ico.org.uk. You may equally lodge one with the Spanish authority, the Agencia Española de Protección de Datos (AEPD), at aepd.es — and that is not merely an option for visitors who happen to live in Spain: the processing described on this page is directed from Spanish territory (see A), so the AEPD is a competent authority over it regardless of where you are. If you are in another EU member state you may also complain to your own national authority.

There is no one-stop-shop here, and that works in your favour. A controller established in the EU can usually be routed to a single lead authority. A UK controller cannot, so the ICO and the AEPD may each supervise independently and neither can refer you to the other as “not their problem”. Under the LOPDGDD the AEPD must also handle a complaint made in Spanish, which the ICO is under no obligation to do.

F. Security incident notification

Our security provider, Cloudflare, monitors traffic to this site for abuse and attacks. If Cloudflare or we identify a genuine security infringement that can be tied to locatable, identifiable data, we will notify the relevant official body without undue delay: the appropriate UK authority (the ICO for a personal-data breach, or the UK's National Cyber Security Centre (NCSC) for a broader cyber incident), and, where the matter concerns Spanish users or data, the AEPD for personal-data breaches and INCIBE-CERT for other incidents. If an official or regulatory body requires access to information from us, the request should be made in writing to oficial@kodamaseclabs.com, and we will respond in good faith within the bounds of what we actually hold.

We are honest that we are still in the process of aligning fully with recognised security standards — this is ongoing work, not a finished certification, and Section 6 below states plainly where we stand. If you find an error, an inaccuracy on this page, or a security issue, please tell us at the same address; we would rather be corrected than be wrong in public. Everything on this site is maintained in good faith, for educational and open-source purposes, by a single independent founder.

3. Cookie Policy (PECR / EU ePrivacy)

We aim for a clean, tracker-free website.

Strictly necessary cookies only

The only cookies set on this site are strictly necessary ones placed by Cloudflare for security purposes (e.g. distinguishing legitimate traffic from automated abuse). We do not set analytics, advertising, or third-party marketing cookies.

Under PECR, consent is not required for strictly necessary cookies; however, in the interest of transparency we display a short notice on your first visit. You can clear cookies at any time through your browser settings, or reopen this notice any time via "Cookie Preferences" in the footer.

Being candid about a grey area: we rely on Cloudflare's own classification of its cookies as strictly necessary for security. This is the standard, widely-used industry position, but some regulators take a stricter view of security/CDN cookies that also touch bot-detection. We're not aware of any finding against this position, but "aiming for maximum compliance" means saying that outright rather than presenting it as beyond question.

What we store on our side — the part this table was missing

Everything above happens in your browser. This part happens on ours, and until 5 August 2026 this page did not mention it at all. That was a real omission rather than a technicality: an IP address is personal data under the UK GDPR, and our edge has been keeping short-lived counters keyed by IP since the security worker was deployed — to stop abuse, which is a legitimate reason, but not one that excuses failing to say so. It is listed now, in full, including the entries that predate the omission being noticed.

That is the complete list. Two other things your browser may send are not stored as personal data: Content-Security-Policy violation reports (we keep only a counter per directive, not the page, the browser or the IP) and Life patterns sent to the shared catalogue (we keep the measured pattern and a count, nothing about the sender). There is no log of which pages you read, no analytics of any kind and no profile. This paragraph changed twice on 5 August 2026 and both versions are worth knowing about. Keys used to carry their own daily counter, which quietly made “three calls a day” into six for anyone who filled the form twice, so grouping them needed an identity. The first fix asked for a name. That worked, but asking is collecting — you had to type something of yours into a form, and the form had to explain what became of it. The second fix removed the field: the account was identified by a client code we generate, and the form asked for nothing about you at all. On 7 August 2026 the form was removed outright (section B0 above); the two paragraphs of that day's history are kept because they describe what was recorded against keys that still exist. Lawful basis: legitimate interests (Article 6(1)(f)) for the abuse counters, since running a public site without any defence against automated abuse is not a realistic option, balanced by keeping them short-lived and single-purpose; and for the API key registry, Article 6(1)(b) — taking steps at your request before, and in order to, provide the thing you asked for. The article is named here for the same reason it is named for the counters: “performing the service you asked for” is a description, not a lawful basis, and the two are easy to blur. The button said Apply for a key and not Register, because there was no account to register for — which is also why there was never a password to lose or a profile to delete, and why removing the form on 7 August 2026 left nothing dangling.

Your rights are awkward here, and honestly so. We hold nothing that identifies you, which means that if you ask us for a copy of your data, or for its deletion, we have no way of telling which rows are yours — unless you quote your client code — it is the only handle that exists, by design. That is a deliberate consequence of not collecting identity, not an evasion: quote the code and we will delete the registration; without it there is genuinely nothing for us to find. The IP-keyed counters expire on their own within a minute or a month and cannot be searched by anything except an address we do not store alongside anything else.

4. Terms & Conditions

Effective date: 5 August 2026 — this revision expands the terms of 1 August 2026; it does not withdraw anything granted by them.

A. Who these terms are between

These terms are an agreement between you and KodamaSEC Labs Ltd, a company registered in England & Wales under company number 16006005, registered office 20 Wenlock Road, London N1 7GU (“we”, “us”, “our”). They cover this website and its subdomains. Separate written agreements govern any paid engagement, and where a signed agreement conflicts with these terms, that agreement takes precedence for the work it covers.

A2. Neutrality, and what we will not take part in

We are neutral, and we intend to stay that way. KodamaSEC Labs Ltd takes no side in political disputes, does not align itself with any party, government, bloc or movement, and will not accept work, funding or collaboration whose purpose is to advance a political position. This is not indifference: it is the condition that lets the mathematics be read by anyone, and a laboratory that has picked a side has already lost the only thing it had to offer.

What we are for, plainly, because neutrality is not the same as having no values:

• Cooperation between peoples, and against armed conflict. We will not knowingly contribute anything — code, results, tooling or advice — to the conduct of war or to any use whose foreseeable purpose is harm.
• The protection of nature and of animals, and the treatment of both as something other than a resource.
• Education, and knowledge that can be read without paying for it. That is why everything published here is free to read and free to disagree with.

And what we will not do: nothing that carries a political message, nothing said against anyone’s religion, nothing directed against any group of people, and nothing that falls outside the rules that apply to us. Where an activity is contentious, or sits in a grey area of the applicable rules, our default is not to proceed. We would rather lose an opportunity than take one we would have to explain away.

A3. Cybersecurity: nothing to anyone, with one exception

We will not provide anything related to cybersecurity. Not products, not services, not consultancy, not audits, not training, not studies, not tooling and not informal assistance — to any person, company or organisation. This restates and widens the commitment on About: that one is about not selling, and this one is about not supplying at all, paid or unpaid.

There is exactly one exception, and it is a Spanish official body. On a request from an official body of the Kingdom of Spain, we will cooperate, and we may authorise full access to the existing code. Our willingness towards Spain and towards Spanish institutions is maximal and is stated here so that nobody has to guess at it: Spain is the first door to KodamaSEC and to every part of its organisation.

We are aware that a commitment of this shape has an edge, so the edge is written down rather than left to be discovered. We are a company registered in England & Wales, and a private company cannot promise to disregard lawful process from the jurisdiction that constitutes it. Where requests conflict at company level, compliance follows London, because that is the law that binds the entity. That is not a preference; it is the fact of where the company is registered, and saying otherwise here would be a promise we are not in a position to keep.

A4. Which law we follow, and where the decision sits

Spanish rules first. If something we intend to build or publish does not comply with Spanish regulation, it does not advance. If no solution can be found that complies, then it advances according to Spanish guidance or it does not advance at all. This is a self-imposed rule and it is stricter than what the company’s own place of registration requires of it, which is the whole point — see the note on choosing your rules before the offer arrives in the statement of record below.

And to be clear about scope and timing, so the orientation toward Spain is not over-read: it is a long-term objective, not a present arrangement. The direction of travel is to integrate into, and where it makes sense to scale within, a Spanish framework or an official Spanish plan over time — done properly, in cooperation with the relevant Spanish institutions and on their terms, not declared unilaterally here. Today there is no Spanish company, branch or public-sector agreement in place (see the Corporate Information above); “Spain first” describes an intent and a preference that would be built out gradually, if and as the opportunity to do it correctly arises. Stating it as an aim rather than a fait accompli is the honest version.

Licensing exists on both sides, and they do different jobs. There is licensing established under Spanish law and licensing held by the United Kingdom entity; neither replaces the other. What separates them is what runs through each: the open-source and non-commercial line stays with London. That is the organisational side of the company — the vehicle through which the work is published as free knowledge, with nothing to buy and nothing withheld — and it is deliberately not the side where money or command sit. If the company ever takes money, that is Spain’s side, structured the Spanish and European way first, as the statement of record below sets out. Keeping the two apart is the point: the part that publishes openly is not the part with an incentive to stop.

The seat of decision is Tenerife, Canary Islands, Spain. The registered office in London is where the company exists on paper and where its obligations as a UK entity are met; the direction of the work is decided here. Both facts are true at once and we would rather state both than let the letterhead imply something the day-to-day does not support.

A5. Nothing here is for unlawful use — and where it is attempted, we report it in both jurisdictions

Nothing on this site is provided for any unlawful purpose, and nothing here is a weapon. The interactive exhibits and free tools are demonstrations of real mathematics — exact arithmetic, a primality test, a cellular automaton — and they carry no offensive capability, no exploit, and nothing built to compromise a system, a network, or another person. Anything that could be unsafe for a visitor, or that could be turned to criminal use, is deliberately not published here (see A3 on cybersecurity, and Section C on what this site is for). You must not use this site, its content, or anything you obtain from it to attempt unauthorised access, to attack or disrupt any system, to harm any person, or for any other purpose that is unlawful where you are or where we operate.

And we say plainly what happens if someone tries. KodamaSEC Labs Ltd is registered in England & Wales and operated from Spain (see Section 2A and A4), so it answers to two jurisdictions at once. Any criminal activity we become aware of — whether attempted against this site, carried out through it, or brought to our attention in connection with it — will be reported to the competent authorities in both: the United Kingdom (via the appropriate London-based channel, as the country of registration) and the Kingdom of Spain (via the appropriate Spanish channel, as the country of operation). This is not a threat; it is simply where a dual-jurisdiction entity is obliged to take such matters, stated up front rather than left to be discovered. We would rather deter it in one sentence here than have to act on it later.

B. Acceptance

By accessing this website you agree to these Terms & Conditions. If you do not agree, please do not use the site. If you are using the site for an organisation, you confirm you are authorised to accept these terms on its behalf.

C. What this site is for

KodamaSEC is an independent research company. This site exists to publish our own research and to show it working: exact-arithmetic algorithms, formal verification, interpretable machine learning, and forward-looking work on post-quantum cryptography and quantum-inspired computing. Everything here is published so that it can be checked — that is the point of it.

It follows that this site is informational and educational. It is not professional, legal, financial, medical or engineering advice, and it is not an offer to enter into a contract. We do not sell goods or services through this website, and it takes no payment. Should the company ever contract work of any kind, it would be agreed separately and in writing, and it would exclude cybersecurity entirely: as stated on About, KodamaSEC Labs Ltd will not sell cybersecurity products, services, consultancy, audits, training or studies, and will not enter any commercial relationship connected to cybersecurity — a commitment about the future, not a description of the present. Interactive exhibits are demonstrations of real computation, not production tooling, and nothing on this site should be relied on as a security control for your own systems.

D. Use of content

You may read, cite, quote and link to this site’s content. You may not reproduce, republish or redistribute substantial portions of its text or design without our prior written permission, except for fair-dealing quotation with attribution. This does not restrict our open-source work. We develop in the open, and where a page, file or repository carries its own licence — source released under an open-source licence, a paper deposited under Creative Commons — that licence governs that item completely. It is not narrowed, qualified or overridden by this section, and nothing here takes back a permission an open licence grants you.

Who owns the research. The mathematical and scientific research published from here — the papers deposited on Zenodo, the Lean formalisations, the public repositories under github.com/joelcanary and their data — is the personal work of Joel Cruz Cabrera (ORCID 0009-0005-4048-1237), published in his own name and under his own ORCID. It is not a work product of KodamaSEC Labs Ltd, is not owned by the company, and does not become so by being described or linked on this site. The company’s own materials are the software, tooling and text of this site as such. Where a repository or deposit carries a licence (Apache 2.0, Creative Commons), that licence is granted by the author and governs the item completely.

Attribute research to its author as shown on the deposit, and the text of this site to KodamaSEC Labs Ltd, linking to the page relied on. Please do not present our results as your own, and please do not quote a result while dropping the qualification attached to it — see section G.

E. Acceptable use

You agree not to use this site, or anything obtained from it, in order to:

• break any applicable law, or help anyone else to;
• attack, overload, probe or interfere with this site or its infrastructure beyond the good-faith security testing permitted in section H — including denial-of-service attempts, credential attacks, or automated collection at a rate or scale that degrades the service for others;
• gain or attempt to gain access to any account, system or data you are not authorised to access;
• introduce malicious code, or use our content or branding to lend credibility to malware, fraud, phishing or any other deception;
• misrepresent what our research shows, or imply an endorsement, partnership, certification or affiliation that does not exist;
• harass, threaten, defame or impersonate any person.

We may withdraw access to the site, in whole or in part, from anyone doing any of the above.

F. Good faith, and mutual respect

We deal with visitors, researchers, collaborators, correspondents and critics in good faith, and we ask for the same. English law implies no general duty of good faith into contracts of this kind, so we state it expressly: we will not use these terms to defeat a reasonable position honestly held, and we will read them the way an ordinary reader would rather than the way a clever one might.

We expect ordinary professional respect in all dealings, and we extend it. We do not tolerate harassment, discrimination, intimidation or abuse of or by anyone connected with our work, in any channel. We do not accept or offer anything that would compromise a professional decision — including any inducement, favour or personal arrangement. Where a conflict of interest arises we disclose it and step back from the decision.

G. Research integrity: evidence, error and correction

Every result published here carries the level of evidence it actually has, and that label is part of the claim. “Machine-checked” and “computationally verified” are different claims, and both are different from “proved”; where a proof is discharged by a tactic that trusts a compiler rather than a proof kernel, we say so and name the axioms it relies on. Nothing on this site should be read as a stronger guarantee than the words attached to it, and where we state a limitation, that limitation is part of the result rather than a disclaimer bolted onto it.

We will get things wrong. Research that is worth publishing is research that can turn out to be mistaken, and a site that never corrected anything would be telling you something about its standards rather than its accuracy. When we find an error — or when you show us one — our practice is to correct it in place, say plainly what changed and why, and keep the record of the earlier version rather than quietly replacing it. Where a paper has been deposited with a DOI, we publish a corrected version rather than editing the record silently. This mirrors the approach recommended by the Committee on Publication Ethics (COPE) for corrections and retractions, though we are not a journal and claim no formal accreditation.

A correction is not an admission of liability, and section J is not narrowed by our making one. We would rather correct a result than defend it.

H. Reporting a security issue — coordinated disclosure and safe harbour

If you believe you have found a vulnerability in a system we operate, please tell us before you tell anyone else. Our contact details, preferred language and reporting address are published at /.well-known/security.txt in the format defined by RFC 9116. Our handling of what you send follows the structure set out in ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling processes); we align our process with those standards and are not certified against them.

Safe harbour. If you make a good-faith effort to comply with this section while investigating a system we operate, we will regard your research as authorised, we will work with you to understand and resolve the issue quickly, and we will not initiate or support legal action against you in connection with it. Good faith here means: you act only against assets that are ours, you stop as soon as you have confirmed a vulnerability, you do not access, modify, exfiltrate or destroy data belonging to us or to anyone else, you do not degrade the service for other users, and you give us a reasonable opportunity to fix the issue before publishing.

Two limits we cannot honestly leave unsaid. First, this authorisation reaches only systems we operate; we cannot authorise anything on third-party infrastructure, including our hosting, CDN and email providers, and their own terms continue to apply. Second, we can bind ourselves and no one else — nothing here restricts a prosecuting authority, and a private assurance is not a defence under the Computer Misuse Act 1990. Stay within this section and the question does not arise.

We do not currently operate a paid bug bounty. We do credit reporters who want to be credited.

On CVE identifiers, so you do not have to guess. We operate a service; we do not ship a product. Nothing published here is software that anyone else obtains, installs and runs, which is the test CVE applies — so a flaw in this site is something we publish, date and fix on Status & incidents rather than something that receives a CVE identifier. We have done exactly that: KSI-2026-002 was a real amplification issue on our own API, found in our own audit and written up in full with the measured numbers. That is the right channel for it, and asking a CNA for an identifier would not have been.

Two things would change that. If we ever distribute software that others deploy, we will request identifiers where they are warranted and say so here. And if a defect we find sits in someone else’s software rather than ours, it goes to that project first under their disclosure terms, not to us and not to a register — and if it is security-relevant, to a CNA as well. Our research findings themselves are mathematics: a theorem has no CVE, and an error in a paper belongs with whoever published the paper.

I. No warranty

Content is provided “as is” and “as available”. We do not warrant that the site will be uninterrupted, timely, error-free or secure at all times, that defects will be corrected, or that the site or its server is free of harmful components. Interactive exhibits compute live and may produce different output on each visit by design. External links are provided for convenience and we are not responsible for the content of sites we do not operate.

J. Limitation of liability

Nothing in these terms limits or excludes our liability for: death or personal injury caused by our negligence; fraud or fraudulent misrepresentation; or any other liability that cannot lawfully be limited or excluded. If you are dealing with us as a consumer, your statutory rights are unaffected by anything in these terms.

Subject to that, and to the maximum extent permitted by law, we are not liable for any indirect, incidental, special or consequential loss, nor for loss of profit, revenue, business, goodwill, anticipated savings or data, arising from your use of this website or from reliance on its content.

In practice there is very little for that to bite on, and it is worth saying so plainly rather than gesturing at large numbers. This website is free, sells nothing, takes no payment, has no clients, and does not provide the software — or any service — to anyone. The commercial-damages scenarios that a limitation-of-liability clause usually guards against simply do not arise here: there is no product being supplied, no engagement being performed, and no sum paid against which any loss could be measured. Nothing on this site should be relied on as a professional service. We deliberately set no invented monetary cap, because a nominal figure with nothing paid to anchor it would be worse protection than none — under the Unfair Contract Terms Act 1977 a limitation has to be reasonable, and a court could strike a derisory one down and take the rest with it.

What we are doing about mistakes, said as plainly as the rest: the honest exposure here is not to a client’s damages, it is to being wrong in the work itself. The specific gaps, scored against what the project actually has, are listed on About. We would rather name the gap and look for the right person to close it than imply a rigour that is not yet in place.

This section governs your use of this website. Liability under a signed engagement is governed by that engagement, not by this paragraph.

K. Unlawful activity, and our right to refuse

We do not assist, advise on, endorse or knowingly work with unlawful activity, and we reject any suggestion that our published research constitutes an endorsement of it.

We reserve the right to decline any engagement, enquiry or collaboration, without giving reasons, including where we judge that the work would be unlawful, would harm identifiable people, would require us to misrepresent a result, or would conflict with these terms. Declining is not an accusation, and we do not have to prove anything to exercise it.

Where we are legally required to report something, we will comply with that obligation, and we will tell you that we have done so unless the law prohibits us from telling you.

L. Governing law

These terms and any dispute arising from them are governed by the laws of England & Wales, and the courts of England & Wales have exclusive jurisdiction. If you are a consumer resident elsewhere, this does not deprive you of the protection of mandatory provisions of your local law.

If any provision of these terms is found unenforceable, the rest continues in force and that provision applies to the fullest extent the law allows.

M. Changes

We may update these terms from time to time; the effective date above reflects the latest revision, and a material change will say what it changed rather than resetting the date silently. Continuing to use the site after a revision means you accept it.

5. Accessibility Statement

KodamaSEC is committed to making this website accessible, in line with the Web Content Accessibility Guidelines (WCAG) 2.1, level AA. This includes:

• Semantic HTML landmarks and heading structure
• Keyboard-navigable menus and links, with visible focus indicators
• A "skip to main content" link on every page
• Sufficient colour contrast between text and background, in both light and dark mode
• Support for reduced-motion preferences

This is independently measured, not just self-declared: an automated Lighthouse audit of the homepage on 31 July 2026 scored 100/100 for Accessibility (mobile, Lighthouse 13.4.1). Automated testing cannot catch everything, so if you encounter any accessibility barrier on this site, please let us know at @KodamaSecLabs so we can address it.

6. Compliance & Performance

Last reviewed: 3 October 2026

We aim for this site to genuinely work toward the standards below, not just claim to. Where a claim is independently measured (like the Lighthouse scores below), we say so; everything else here is a good-faith attempt at alignment, not a finished certification. If anything below turns out to be wrong, incomplete, or has changed, tell us at @KodamaSecLabs and we'll correct it as fast as we'd fix a bug in our own code — the same standard the rest of this site holds itself to (see Methodology).

EU AI Act, Article 50 — transparency obligations (enforceable since 2 August 2026)

A new obligation, checked the day it took effect rather than assumed away. Article 50 of Regulation (EU) 2024/1689 requires (a) providers of AI systems intended to interact directly with natural persons — chatbots, conversational agents — to disclose that a user is talking to an AI, unless that's already obvious from context, and (b) markers on AI-generated or AI-manipulated image/audio/video content presented as authentic (deepfakes/synthetic media). Non-compliance carries penalties under Art. 99, as one would expect of an EU regulation — we note that only to be clear we have read the enforceable part, not to dramatise a number that does not apply to us. The operative question is whether these duties bind anything this site does, and the next paragraph is our answer: on our reading, they do not.

Our own read, stated as exactly that and not as a regulator's determination: nothing on this site appears to trigger it. The animated character across this site has no free-text input and generates no novel language — everything it "says" is either a fixed, pre-written line or the literal output of a real, deterministic computation (a gcd, a primality test, a 2-adic valuation) rendered as text, the same numbers anyone can already read directly on The Notebook. It is not a chatbot and does not hold a conversation. Nothing on this site generates or manipulates image, audio, or video content presented as authentic — every visualisation here (the Game of Life layer, the procedural terrain, the factory city, the chess tablebase) is deterministic algorithmic output from real computation, not model-generated synthetic media. On that basis Article 50's disclosure and marking duties don't appear to apply to anything this site currently does. We'll revisit this immediately, not at the next scheduled review, if that changes, if we add anything that does interact conversationally, or if we're told our reading is wrong.

Separately, and stated plainly rather than left implicit: parts of this site's own code and documentation have been built with AI coding-assistant help (Claude, Anthropic) — a development-tooling fact, not an Article 50 event, since the assistant doesn't interact with this site's visitors or generate content presented to them as its output. We disclose it anyway, in the same spirit as everything else on this page: say the true thing rather than the minimum required thing.

In plain terms, since the two questions people actually ask are simple ones:

• Is any of the art or animation here AI-generated? No. Every moving thing on this site — the character, the reaction-diffusion field, the Game of Life, the procedural terrain, the factory city, the chess tablebase — is deterministic mathematics computed live, not an image, sound or video produced or altered by a generative model. There is no synthetic media presented here as authentic, so there is nothing for Article 50(4)'s marking duty to attach to. If we ever did exhibit work generated or manipulated with a model such as Anthropic's Claude, we would label it as AI-generated, clearly and next to the work — and until you see that label, there is none.
• When I use a tool or a challenge, am I interacting with an AI? No. The tools and the challenge checks are exact algorithms — they run the same computation every time and show you the working — not a machine-learning system evaluating your answer or holding a conversation. You are not talking to a model, and nothing here decides anything about you. If that ever changed — if a feature did use an AI system to interact with you or judge a response — we would tell you so at the point of use, because Article 50(1) requires it and because it is the honest thing to do.

The AI Act's high-risk-system obligations (Annex III: credit, employment, education, and similar) are not yet enforceable — postponed to 2 December 2027 (2 August 2028 if embedded in an already-regulated product, e.g. medical devices) — and don't describe anything this site does regardless of timing. Spain's own implementing organic law, once published in the BOE, will supply local enforcement machinery for the EU regulation above; it doesn't change what's already directly enforceable today under EU law, which doesn't wait for national transposition.

Security governance, stated like a CISO would, not a marketing page

The ISO/IEC 27001-informed bullet below means concretely this — a short, honest ISMS-shaped status note, not a certified one:

• Asset inventory: small and real, not abstracted away — two machines described in real terms on Methodology, a Cloudflare Workers edge deployment, and a short, named list of vendored third-party libraries with their own tracked versions (see Methodology's cryptographic bill of materials). Nothing sprawling enough to lose track of.
• Access control: a single controlling party (KodamaSEC Labs Ltd), no shared or federated accounts, deploy credentials held outside anything that ships to a browser.
• Change management: every deploy runs the same scripted pipeline — minify, obfuscate our own code (never third-party vendored code), compute Subresource Integrity hashes, publish an integrity manifest — described honestly above, not just asserted.
• Incident handling — the real gap: no formal written incident-response plan exists yet. Said plainly rather than left for an audit to find: a site this size with this little attack surface (no visitor database, no user accounts, no payment processing — see Section 2) has a materially smaller blast radius than ISO 27001's full framework is built to cover, but smaller risk isn't zero risk, and implying otherwise by omission would be exactly the kind of confident-sounding overstatement this whole page exists to avoid.
• Next, concretely, not indefinitely deferred: a written incident-response runbook and a documented risk register are the two specific next steps.

Regulatory contact, stated plainly

KodamaSEC Labs Ltd is on the UK Information Commissioner's Office (ICO) register of fee payers as a data controller, reference ZC210720, registered 31 July 2026 and expiring 30 July 2027, payment tier 1 — verifiable on the regulator's own register rather than on our word for it. To be unambiguous about what that is and isn't: paying a data protection fee and appearing on that register is not an approval, endorsement, or certification — the ICO has not approved, certified, endorsed, or issued any finding about KodamaSEC Labs Ltd or this site, and nothing here should be read to imply otherwise. We are not opposed to any government or regulatory audit at any level, including of our source code — everything on this site is already public at the level shown, our research data and references are described honestly throughout Methodology, and (see Section 2) we do not currently operate any database of visitor or user data. If any of that changes, this page will be updated to say so at the time it changes.

What we are working to align with

• The UK GDPR and the Data Protection Act 2018; Regulation (EU) 2016/679 (GDPR); and Spain’s Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD) — all three, because the controller is UK-registered and operated from Spain (see Section 2A). Complaints may go to the ICO or to the AEPD.
• PECR / EU ePrivacy rules on cookies (see Section 3)
• Companies Act 2006 corporate transparency, and Germany's Impressumspflicht (§5 TMG / DDG) (see Section 1)
• WCAG 2.1, level AA — independently measured via Lighthouse, see Section 5
• Engineering practices informed by OWASP secure-development guidelines and MITRE's ATT&CK / CWE frameworks
• Information-security practices informed by the structure ISO/IEC 27001 sets out (asset inventory, access control, incident handling, change management) — we are not ISO 27001 certified, and won't describe ourselves that way until an accredited external audit says so; this is a good-faith working target, the same honesty this whole section already applies elsewhere
• INCIBE's (Instituto Nacional de Ciberseguridad, Spain's national cybersecurity institute) published public guidance for companies in the cybersecurity sector, as the practical standard we hold ourselves to rather than inventing our own

What actually changed recently, so this section stays honest

Concretely, not just as a stated aim: every script and stylesheet this site loads now carries a Subresource Integrity hash, checked by the browser itself against what we published at deploy time — if a file were ever served differently from what we shipped, the browser refuses to run it rather than trusting it blindly. Our own JavaScript is obfuscated on top of being minified before it ships (vendored third-party libraries are left as-is and rely on SRI instead, since obfuscating someone else's code protects nothing). The arithmetic/security logic behind the free tools and this site's own headers now lives outside the web-reachable document root entirely — not just access-restricted, structurally unreachable by any URL, the same root-cause fix behind the /api issue visitors may have noticed briefly on 2 August 2026 (a stray directory colliding with a clean URL, found and fixed the same day).

Measured performance

Lighthouse audit of kodamaseclabs.com, mobile (emulated Moto G Power, throttled slow 4G), 31 July 2026, 21:11 WEST:

These figures are under simulated slow-4G throttling, a deliberately harsh test condition — real-world load on typical connections is faster. We're not going to round this up to "loads in under 2 seconds"; the number above is the honest one.

United States

We checked the main US frameworks that could plausibly apply to a small research site with international visitors:

• CCPA / CPRA (California): not applicable — it only binds businesses above specific revenue or data-volume thresholds (broadly, about $26.6M+ annual revenue, or personal data on 100,000+ California consumers, or 50%+ revenue from selling/sharing personal data). We meet none of these, and we don't sell or share data in the first place.
• COPPA (children's privacy): not applicable — this site is not directed at children and does not knowingly collect data from children.
• CAN-SPAM: not applicable — we send no marketing email; there is no newsletter or mailing list.
• ADA Title III (accessibility): the WCAG 2.1 AA target and the independently measured Lighthouse Accessibility score (Section 5) are the same standard most US accessibility claims are judged against, so this work covers both the EU/UK angle and the US one.

Other EU frameworks we checked

Considered and not currently triggered, for transparency:

• Digital Services Act (DSA): applies to intermediary/hosting/platform services; this is a static informational site with no user-generated content, so it falls outside DSA's core obligations.
• NIS2 Directive: applies to essential/important entities above certain size thresholds in specific sectors; a solo-founder research site doesn't meet the entity criteria.
• European Accessibility Act (EAA): targets specific consumer products/services (e-commerce, banking, e-books, etc.); we sell nothing, but we hold ourselves to WCAG 2.1 AA anyway.

Spain, specifically — checked by law name, not assumed from the EU-level framework above

• Ley 11/2023, de 8 de mayo (Spain's transposition of the EAA, Directive 2019/882): in force for new products/services since 28 June 2025. Its Annex lists the specific covered categories — e-commerce, consumer banking, e-books, transport ticketing/booking, telecoms, audiovisual media services — and a static research site that sells nothing falls outside all of them. It also carries an explicit microenterprise exemption (fewer than 10 employees and under €2,000,000 annual turnover or balance sheet); KodamaSEC, a solo-founder operation, clears that threshold by a wide margin regardless. Neither exemption is why we bother with WCAG 2.1 AA, though — we hold ourselves to it anyway (Section 5), same as the EU-level EAA bullet above.
• Real Decreto 1112/2018: Spain's separate, earlier accessibility regulation, transposing a different EU directive (2016/2102). Its own stated scope is exclusively the public sector — state, regional and local administrations, and entities that receive public funding for their site or app. KodamaSEC Labs Ltd is a private company that received no public funding for this site; this decree was never in scope here, and we checked its actual text rather than assumed.

Asia-Pacific: Japan & China

Checked, for visitors from these regions specifically:

• Japan — APPI (Act on Protection of Personal Information): APPI can apply extraterritorially to services aimed at individuals in Japan. We collect no personal data beyond the automated security logs described in Section 2, and we don't target or sell into the Japanese market, so APPI's handler obligations aren't substantively triggered — visitors from Japan get the same treatment described throughout this page.
• China — PIPL (Personal Information Protection Law): the same reasoning applies — no personal data processing beyond baseline security logs, no targeting of the Chinese market, and none of our infrastructure is hosted in mainland China, so PIPL's data-handling and data-localisation requirements don't apply here.

In both cases, the underlying reason is the same one that clears most other frameworks on this page: we don't collect, sell, or process personal data beyond what our security provider logs automatically and any email you choose to send us, regardless of where a visitor is.

What this page is — and isn't

This page is a genuine, good-faith account of how the site actually behaves, checked against real audits rather than assumed. It is not a substitute for independent legal or security certification: if you rely on this for a formal compliance process, have it reviewed by a qualified lawyer or accredited auditor first. We'd rather say that plainly than imply a guarantee this document can't give.

7. Compliance posture — the whole board, including the empty squares

Last reviewed: 5 August 2026

Most compliance pages are a list of things a company has. That shape is dishonest by construction: the interesting information is what is missing, and a page that can only ever grow tells you nothing about where the gaps are. So this is the whole board. Held, aligned-but-not-certified, in progress, and not in place — in the same table, with the same weight.

Two distinctions are load-bearing here and are collapsed almost everywhere else. Aligned is not certified: following a standard’s structure is a real engineering choice and it is not an audit, and anyone claiming ISO 27001 without a certificate is claiming something they do not have. Our own audit is not an independent one: we reviewed this site against the OWASP Top 10 and gave it a B+, and we are not a neutral party to that.

The published record, in full

7 live deposits, every one a preprint. The canonical list is ORCID 0009-0005-4048-1237, which is the record to trust if this page ever falls behind it. Each DOI below is a Zenodo concept DOI: it always resolves to the newest version of that deposit, so a link here cannot quietly start handing you an older paper. Two of these have a second version and the ORCID entry still points at the first — said here because the canonical record being the stale one is worth knowing.

1. The Life-like rule B37/S2378: an exhaustive census of 4×4 seeds, disk-shaped growth, and two oscillators with machine-checked periods — first deposited 26 September 2026, 2 versions · 10.5281/zenodo.22974274 Version 2, deposited the same day, corrects how many seeds the census evolves: the 51,472 whose bounding box is exactly 4×4, not every one of the 65,535 patterns of the box as the first version said. The code, the data and the Lean proofs are open at github.com/joelcanary/life-like-rule-b37s2378.
2. Exact Retrograde Analysis and Machine-Checked Verification of the King and Rook versus King Endgame — first deposited 4 August 2026 · 10.5281/zenodo.21797907 A corrected version follows: the first release described its five Lean 4 theorems as “kernel-checked” when they are closed by native_decide, which trusts the compiler rather than the proof kernel.
3. Exact Entanglement Entropy and Code Distance for Stabilizer States, Computed Without Floating-Point Arithmetic — first deposited 27 July 2026, 2 versions · 10.5281/zenodo.21628150
4. A Weighted Redheffer Determinant Identity — first deposited 24 July 2026, 2 versions · 10.5281/zenodo.21535914 The landscape in the strip at the foot of every page on this site is M(n), the Mertens function this paper is about.
5. The Noether–Lefschetz Window of a Smooth Surface in P^3 and the OEIS Sequence A005581 — first deposited 24 July 2026, 2 versions · 10.5281/zenodo.21535860
6. Computational Results on the Congruent Number Family: E_n : y² = x³ − n²x — first deposited 24 July 2026 · 10.5281/zenodo.21535499
7. Three Exact Results Arising from Collatz-Type Dynamics: Valuation Equidistribution, Fermat Bases, and a Transcendental Density Constant — first deposited 23 July 2026 · 10.5281/zenodo.21516620

And one withdrawn. The Kodama Observable for Collatz Dynamics: Exact Decomposition, Residual Dynamics and Experimental Evidence up to 10^8 (10.5281/zenodo.21087140) was retracted by its author on 6 July 2026 and now resolves to a Zenodo tombstone. It is still listed on the ORCID record, so it is listed here too: a withdrawal that only the person who made it can see is not a withdrawal, it is a deletion. Withdrawing a preprint you no longer stand behind is the system working, and it belongs on this board for the same reason the native_decide correction does.

None of them has been peer-reviewed, which is why the peer-review row above says what it says. A Zenodo deposit is a public, dated, citable record of what we claimed and when. It is not a second opinion.

What we have submitted, and what is moving

• Deposited — 4 August 2026. The KRK endgame paper, to Zenodo, with a DOI. Deposited, not reviewed.
• Corrected — 5 August 2026. That paper described five Lean 4 theorems as “kernel-checked”. They are closed by native_decide, which trusts the compiler rather than the kernel. We found it, we corrected the site and the sources the same day, and a corrected version of the paper follows rather than a silent edit. It is on this board because a compliance page that only lists successes is a marketing page.
• Audited internally — 2 August 2026. OWASP Top 10 review of this domain, grade B+, three recommendations outstanding (the two header items and the HSTS extension in the table above).
• Verified — 5 August 2026. The ICO registration was checked against the regulator’s own public register on this date: reference ZC210720, data controller Kodamasec Labs Ltd, registered 31 July 2026, expiring 30 July 2027, payment tier 1, at 20 Wenlock Road, London N1 7GU. Every one of those matches what this page states. Checked rather than assumed, because a compliance page repeating its own earlier claim is not evidence of anything.
• In progress. Reconciling that registration with the ICO’s own self-assessment tool, which does not obviously require a fee from an organisation of this shape. The registration itself is not in question — it is live, paid and verifiable at the link above; the open question is only whether it was required, and we would rather pay a fee we did not owe than owe one we had not paid. Also: applying the three outstanding recommendations from our August audit.

What we have to face next

Dated where a date exists, and explicitly undated where one does not. We would rather show an open item with no date than invent a commitment.

• A presence in Tenerife, Canary Islands — intended, not yet constituted. The company is preparing to open in Spain and the director already holds Spanish tax registration; the ZEC (Zona Especial Canaria) regime is being evaluated. Nothing is registered yet, so this page names no Spanish address and no CIF, and will not until there is one to name.

  The form is still open between a branch (sucursal, no separate legal personality but its own Spanish registration, accounts and tax obligations) and a Spanish subsidiary (S.L., a second legal person). Earlier revisions of this page said the plan was the subsidiary; that is now the open question rather than the answer, and saying so is more useful than leaving a superseded plan standing.

  The data-protection half of this has already happened, and section 2 has been rewritten accordingly. It used to sit here as a future event. It is not one: the director is resident in Santa Cruz de Tenerife and registered there as a self-employed professional, so the processing is already directed from Spanish territory, the GDPR and the LOPDGDD already apply alongside the UK regime, and the AEPD is already a competent authority alongside the ICO — not instead of it. Waiting for a company registration before saying so would have been waiting for the wrong event — what triggers Spanish law is where the decisions are taken, not what is on a certificate. See 2A, 2D2 for the transfers in both directions, and 2E for the two authorities.

  What is still genuinely future is the entity, and it is worth being precise about why. Today the director trades as an autónomo, which means unlimited personal liability: there is no separation between the project’s obligations and his own assets. Incorporating a Spanish S.L. would put a limit on that, and only a company — not a self-employed individual — can apply to the Zona Especial Canaria (ZEC) at all. Neither step has been taken and neither has a date.

  So there are exactly two things here, and they are not the same thing. Said as flatly as it can be said, because every other way of writing it flatters us:

  • KodamaSEC Labs Ltd exists — a company registered in England & Wales, number 16006005, incorporated 8 October 2024. It holds the domain, the ICO registration and this website.
  • There is no company in Tenerife. None has been incorporated, none is in the process of being incorporated, and no application has been filed. What exists in the Canary Islands is one self-employed individual: the director, registered as an autónomo. That is a personal registration of a person, not a business establishment of anything. Anyone reading “our office in Tenerife” into this page is reading something that is not there.

  What the London company has actually done, from the registrar rather than from us

  It has no turnover. Not “little”, not “not yet material”: none. And that is not our characterisation — the company’s filed accounts are dormant company accounts, which is a formal Companies House status meaning no significant accounting transaction occurred in the period. The whole file is four documents and you can read it yourself on the filing history:

  KodamaSEC Labs Ltd — complete filing history as at 7 August 2026. Four documents in twenty-two months.

  Date	Type	What it is
  28 Jul 2026	AA	Accounts for a dormant company, made up to 31 October 2025 — the filing that says, on the public record, that the company traded nothing.
  10 Oct 2025	CS01	Confirmation statement made on 8 October 2025, with updates.
  7 Oct 2025	CS01	Confirmation statement made on 7 October 2025, with updates — there are two three days apart because the first needed correcting.
  8 Oct 2024	NEWINC	Incorporation, model articles, statement of capital GBP 1. One pound. That is the whole share capital.

  Nothing on that record is overdue, and we are not going to describe a company with four filings as anything more impressive than it is. It is a young, dormant company that is keeping its statutory obligations current and nothing else. If a filing ever does fall overdue, it will appear on that link before it appears on this page, which is the correct order.

  Every cost has been paid personally by the director. Domain, hosting, the Cloudflare account, the ICO fee, the incorporation, the compute for the research — all of it out of Joel Cruz Cabrera’s own money, with no external funding, no grant, no investor, no loan and no revenue behind any of it. The dormant accounts are the other side of that same fact: the company has no income because the person has been paying instead. It is said here because the word “lab” can be made to sound like an institution, and this one is a man paying for his own servers.

  The SIC codes, what they mean, and why they are already a poor fit

  Companies House requires every company to declare what it does using SIC codes (Standard Industrial Classification) — a fixed statistical list, chosen at incorporation. Ours are these, and this is what each one actually covers:

  Declared at incorporation. A classification for statistics, not a licence, a permission or a description of what we have ever done.

  Code	Official wording	What it means, and how well it fits
  62020	Information technology consultancy activities	Advising others on their IT. We have never done this — no clients, no engagements, no invoices.
  62090	Other information technology service activities	The catch-all for IT work that fits nowhere else. The closest of the four to what actually happens here, and still a stretch.
  63990	Other information service activities not elsewhere classified	The catch-all for information services. Publishing research on a website arguably lands here.
  71122	Engineering related scientific and technical consulting activities	Scientific and technical consulting. The scientific and technical half fits; the consulting half does not, because there is nobody to consult for.

  All four describe selling services, and we sell none. There is no SIC code for “independent mathematics and software research funded personally and given away”, and the honest thing is to say the codes are approximately wrong rather than to let them imply a consultancy that has never existed. They were chosen at incorporation, when the shape of this was less settled than it is now.

  They will have to be adapted, twice over. The UK codes can be updated on a confirmation statement, and should be, so the register stops describing an IT consultancy. And Spain does not use SIC at all: a Spanish entity would be classified under CNAE-2009, a different list with different numbers, chosen at the point of registration and not translatable code-for-code from these. Neither has been done. It is on the board above rather than in a plan we have not written.

  And the ZEC is not a form to fill in. Article 31 of Ley 19/1994, de 6 de julio, de modificación del Régimen Económico y Fiscal de Canarias (Law 19/1994 of 6 July, amending the Economic and Tax Regime of the Canary Islands) requires a registered entity to create a net minimum of five jobs on Tenerife or Gran Canaria — three on El Hierro, Fuerteventura, La Gomera, Lanzarote or La Palma — within six months of registration, and to hold at least that average thereafter, alongside a minimum investment in fixed assets located in the ZEC area within the first two years. The word doing the work is net: the requirement is real employment genuinely attached to the new entity, not headcount moved across from somewhere it already existed. We record it here at the point of intention rather than discovering it later, because a tax regime entered without meeting its conditions is a debt, not a saving.

  One thing we were told and are not printing. A recent judgment of the Audiencia Nacional was cited to us as authority for exactly that last point. We could not find it, so it is not on this page. The statutory requirement above is verified against the law itself and stands on its own; the case reference stays in our notes until somebody puts the text in front of us. This site has twice published papers whose citations turned out not to exist, both caught by audit and both written up on Challenges — a legal page is the last place to make that mistake a third time.

  What would still change on the day an entity exists. Section 4A will have to say which entity you are contracting with, and the England & Wales governing-law clause in section 4L will have to be revisited rather than inherited: LSSI-CE and Spanish consumer law come into scope for Spain-facing activity. A Spanish address and CIF would be named here the day there is one, and not a day before.

  Also outstanding, and listed because it is not done: a record of processing activities (registro de actividades de tratamiento) covering the Spanish operation.

  If there is ever commercial activity, where it would come from and what it would refuse

  There is none today, and section 1 says so without hedging: no revenue, no clients, none sought. What follows is not an offer, a solicitation or a prospectus. It is a position stated in advance, because a company that decides its principles at the moment it is offered money decides them badly.

  Any future commercial relationship would be entered into from a Spanish company in Tenerife, not from the London company. That entity does not exist yet (above). Until it does, nobody can contract with “the Tenerife office”, because there is not one, and any approach on that basis should be treated as a mistake or as somebody trading on a name that is not theirs.

  Markets we would be open to, said plainly: Germany and the wider EU; the United States; Japan; China; and Latin America. That is an openness, not a presence — we hold no entity, no representative and no registration in any of them.

  Sanctions, and the order we would follow. Any counterparty would be screened against the sanctions and restrictive-measures lists in force — the EU consolidated list, the UK’s OFSI list and the United States’ OFAC lists — and where they disagree we would apply the strictest of them, not the most convenient. In particular, if a jurisdiction becomes restricted under United States measures, our structure follows that restriction rather than looking for a way around it, and it does so even where EU or UK law would permit the transaction. That determination is not the CEO’s to make. It is a question for qualified advisers on the specific facts, and the CEO’s own view is explicitly not the test — naming that here is the point of writing it down before there is a deal on the table.

  And the order of authority, whatever the market. The CEO’s standing instruction is that Spanish and European law and guidance come first in the structuring of any arrangement, whatever territory it is aimed at, and that the United Kingdom is treated as a place where good practice is brought rather than a lighter regime to be routed through. Where a foreign market would permit a structure that Spanish or EU rules would not, the answer is the Spanish or EU one. That is a self-imposed order, not a legal requirement, and it is written here so that departing from it later would be visibly departing from something.

  What would be refused regardless of the money. Cybersecurity products, services, consultancy, audits, training or reports — permanently, and section 4 already excludes them from the terms rather than leaving it to goodwill. And no work whose purpose or effect is political messaging or campaigning, attacking or disparaging any religion or its followers, or targeting, profiling or discriminating against any group by ethnicity, nationality, religion, sex, gender identity, sexual orientation, disability, age or migration status. This site publishes mathematics. It does not take positions on those things and will not be paid to.

  No date committed. The legal analysis behind this is the company’s own and has not been reviewed by a Spanish solicitor; that review is the next item on this list.

• Legal review of sections 4 and 7 by a solicitor. No date committed.
• Cyber Essentials. The UK scheme most likely to be asked for first. No date committed.
• An independent security test. Our own B+ is not a substitute and we do not present it as one. No date committed.
• Peer review. Deposited work is not reviewed work, and we will keep saying so until that changes. No date committed.
• Site-wide accessibility audit. One Lighthouse score on one page is where we are, not where this should end. No date committed.

Why this page exists

So that a visitor can establish what this company actually has without asking for it, and without reading between the lines of a page engineered to imply more than it says. The gaps above are real and some of them are unflattering. They are here because a security company that cannot publish its own open items has not understood what it is asking its customers to trust.

If something on this board is out of date, wrong, or reads as stronger than the evidence behind it, tell us at @KodamaSecLabs and we will correct it and say what changed.