What is the API and ecosystem strategy? Is this a closed app, or are you building something others build on — and where is the evidence?

The full executive answer

The strategy is platform-by-stages, and each stage is priced into the tier ladder rather than vaporware. Programmatic access lands at Max: API keys for the public API, the TypeScript and Python clients generated from its OpenAPI contract, and signed outbound webhooks with a delivery-and-retry subsystem. The public API reads and, since October 2026, writes: risks, incidents, vendor inventory and KPI actuals can be created and updated with separately scoped write keys, and webhook subscriptions managed. Pushing data into a customer’s own data warehouse and dashboards embedded in other tools are not shipped, and we say so rather than sell them. The API layer itself is built to platform grade — OpenAPI-specified, versioned, with a consistent response envelope.

The marketplace is the ecosystem keystone, and its security model is the deliberate part: partner apps request scopes from a fixed registry — read scorecard, read roadmap, read risks, read compliance and so on — and the customer grants a subset at install; scopes are read-only today by design. For a governance product, an ecosystem that starts read-only is the credible sequencing: partners can build reporting, BI and workflow integrations without any partner app being able to mutate board data. Write scopes come later, behind a partner review process — that is roadmap, stated as such.

Strategically this is Bill Gates’ platform test — a platform is when the ecosystem’s economics exceed the platform owner’s. We are honestly at stage zero of that: the rails exist, the marketplace has no third-party apps yet. But the sequencing — read SDK at $149, full API at Max, least-privilege marketplace — is how a one-person company makes itself extendable before it can afford an ecosystem team.