Storage is not verification.
Drive, DocSend and every virtual data room solve the same problem: getting files to an investor and knowing when they opened them. None of them read the numbers inside. A cap table that contradicts a term sheet uploads exactly as cleanly as one that reconciles — and diligence finds the difference on day three.
Files are opaque to the folder
A VDR indexes, encrypts and tracks access. It has no model of what a share count is, so it cannot know that your holders sum to 26,250 while your articles declare 25,000.
The contradiction is preserved perfectly, at rest, in triplicate.
13 deterministic rules, named and published
Every generation runs the same finite rule set and reports which rules fired, which passed, and which could not run for want of data. Missing input is never reported as a pass.
rule captable_share_sum HARD holder shares 26,250 ≠ declared 25,000 rule founder_equity_vs_captable HARD states 40% · holds 45% of 25,000 rule esop_pool_vs_captable NOT RUN
One change, eighteen places to remember
Move the pre-money and you re-open the deck, the cap table, the term sheet, the ESOP schedule and the model — by hand, at 11pm, three days before the raise.
The file you forget is the one they check.
Every document reads one source
Price per share, pre-money, post-money and the financial model all recompute from a single asserted input. The term sheet and the cap table cannot disagree, because they read the same computation.
Not a reconciliation step you have to remember to run — an architecture in which the mismatch has nowhere to form.
Any number can be quietly revised
Version history tells you a file changed. It does not tell you which assertion changed, who stood behind it, or whether the figure an investor reviewed on Tuesday is the figure in the folder on Friday.
The database refuses the edit
Confirmed facts, findings and certificates are insert-only — enforced by row-level triggers, not by policy or good intentions. Nothing is generated until a human confirms each asserted fact at the consent gate.
UPDATE public.certificates … ERROR 23514 append-only table: certificates cannot be UPDATE (audit-trail rule #11)
The number has no origin
A figure in a data room is an assertion with no traceback. When counsel asks where 25,000 came from, the answer is a spreadsheet someone no longer has.
Every fact carries its receipt
Extraction must produce a verbatim quote, and the code verifies that quote occurs in the source and contains the value. A quote that isn’t in the document is rejected however confident the model claims to be.
finding → founder_equity_vs_captable
→ fact data.captable.total_shares = 25000
→ src Articles_of_Association.pdf, p.1
→ quote "Stammkapital 25.000 EUR" ✓How it works — the actual product
Real screens from a real generation, run on the AeroFlux sample company. The contradictions below are the ones the engine actually found. Nothing staged.
Answer the interview, confirm every fact
No 60-field form. A resumable conversation that asks only what your documents need — founders, cap table, ESOP, term sheet.
Nothing is generated until you confirm each asserted fact. That consent gate is enforced in code: the engine refuses to run without it, and what you confirm is written to an append-only ledger that cannot be edited afterwards.
This screen sits behind the consent gate, so it isn’t shown here. Everything below is a real capture.
Eighteen documents, generated in lockstep
Founder agreement, incorporation, shareholders’ agreement, cap table, ESOP, NDA, IP assignment, employment contracts, policies, pitch deck, financial model, term sheet — compiled from one source.
Change the pre-money once and every document recomputes together. Gaps we can’t support render as a visible [ TO BE COMPLETED ] — never invented.
Findings, ranked worst-first
Thirteen deterministic rules run on every generation. A HARD finding is arithmetic — two documents state things that cannot both be true. A REVIEW is coherent but needs your decision.
Each finding names the rule that produced it, so you can check our work rather than take it on faith.
The same check, from your terminal
The engine is the engine. The CLI shells out to exactly the same rules the web app runs — there is no second implementation that could disagree.
It exits 2 when contradictions exist, so a CI pipeline can gate a release on financial drift the same way it gates on a failing test.
$ movokai verify --tenant aeroflux DRAFT — UNCONFIRMED (not signed in) Rules run in full; no certificate will be issued. Verdict: HARD HARD 2 · REVIEW 1 · INFO 0 · 7 open gaps HARD Cap table: holder shares sum (26250) ≠ declared total (25000). rule: captable_share_sum HARD Founder agreement vs cap table: Elena Rostova states 40% but holds 11,250 of 25,000 (45.0%). rule: founder_equity_vs_captable REVIEW IP assignment: 2 contributors named, no IP Assignment Agreement recorded for anyone. rule: ip_assignment_provenance certificate: not issued — draft run, facts not confirmed $ echo $? 2
A certificate your investor's lawyer can check
Once your facts are confirmed, every room ships a Consistency Certificate: the verdict, every rule in the published set and whether it fired, passed, or could not run for want of data.
It carries a SHA-256 over its own contents — edit a recorded finding and the hash changes — and it publishes its own limits. Insert-only at the database level, so it cannot be altered after issuance.
A €1M change nobody propagated
A round is negotiated from €8M down to €7M on the same post-money. New investor dilution should fall from 25% to 22.6%. Miss the propagation and you hand over an extra 2.4% of the company to a variable nobody updated.
- Term sheet€7,000,000
- Pitch deck€8,000,000
- Cap table25.0% dilution
- ESOP top-upsized to €8M
- Financial model€8M runway
Four documents still describe a round that no longer exists.Every upload succeeded. Nothing was flagged, because nothing was reading.
- Term sheet€7,000,000
- Pitch deck€7,000,000
- Cap table22.6% dilution
- ESOP top-upre-sized
- Financial modelrecomputed
One edit. Eighteen documents in lockstep.The stale-variable class of error has no surface to exist on.
What the other tools are actually for
| Tool | Genuinely good at | Reads the math | Audit trail of assertions |
|---|---|---|---|
| Google Drive / Notion | Storing and sharing anything | no | no |
| DocSend / Papermark | Access control and view analytics | no | no |
| Traditional VDR | Permissioned rooms, Q&A, logging | no | file access only |
| Stripe Atlas / Clerky | Attorney-backed formation documents | no | at formation only |
| Carta | Equity admin after the round closes | cap table only | not across documents |
| General AI chatbots | Drafting prose quickly | hallucinates arithmetic | no |
| Movokai | Proving the documents agree before diligence | 13 rules | append-only |
The limits, published
A verification company that overstates its own capabilities has already failed its own test. So the certificate carries this list too:
- A finite rule set, not a proof of correctness. 13 named rules run, and the certificate lists every one and what it returned. Two known gaps are on the record: the cap-table percentage column isn’t validated to 100%, and share capital in euros isn’t reconciled against share count.
- No public-registry verification. Handelsregister cross-checking is not live. A self-reported fact is never labelled “verified” — at most “consistent with the public record”, and only once a real authority has been queried.
- Facts come from the founder. Every underlying figure is asserted by the company and confirmed by its representative. We check that the documents agree with each other; we do not independently audit the business.