What is the API and ecosystem strategy? Is this a closed app, or are you building something others build on — and where is the evidence?

The full executive answer

The strategy is platform-by-stages, and each stage is priced into the tier ladder rather than vaporware. Read access starts early: TypeScript and Python SDK read access ships at Basic — $149 a month — because an ecosystem starts with people pulling their scorecard into their own tools. Full programmability lands at Max: complete SDK, outbound webhooks with a delivery-and-retry subsystem, and a write API. Enterprise adds warehouse sync and embedded analytics, because at that scale we are a data source in their stack, not just an app. The API layer itself is built to platform grade — OpenAPI-specified, idempotency-keyed, with a consistent response envelope.

The marketplace is the ecosystem keystone, and its security model is the deliberate part: partner apps request scopes from a fixed registry — read scorecard, read roadmap, read risks, read compliance and so on — and the customer grants a subset at install; scopes are read-only today by design. For a governance product, an ecosystem that starts read-only is the credible sequencing: partners can build reporting, BI and workflow integrations without any partner app being able to mutate board data. Write scopes come later, behind a partner review process — that is roadmap, stated as such.

Strategically this is Bill Gates’ platform test — a platform is when the ecosystem’s economics exceed the platform owner’s. We are honestly at stage zero of that: the rails exist, the marketplace has no third-party apps yet. But the sequencing — read SDK at $149, full API at Max, least-privilege marketplace — is how a one-person company makes itself extendable before it can afford an ecosystem team.