# POL-242 — Never assert a fact about the business nobody has confirmed

> A generated document must assert no fact about the business — retention periods, encryption, sub-processors, certifications, jurisdictions — that has not been sourced or confirmed by the user.

- **Rule ID:** POL-242
- **Layer:** Policy pages (`POLICY_PAGE`)
- **Checks:** `generated policy factual assertions`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Human check — only someone holding the document can settle it
- **Fix type:** Supply evidence only you hold
- **Required by:** FTC, TCR
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/policy-page/pol-242/

## Why this rule exists

Every invented fact in a privacy policy is a public representation the business will be held to, and the ones a generator reaches for are exactly the ones nobody checks: a thirty-day retention period, AES-256 at rest, a SOC 2 report that does not exist. The FTC treats a false privacy claim as a deceptive practice, so this is the one obligation in the layer where the consequence is an enforcement action rather than a rejection.

## How to fix it

Confirm each factual claim with the person who would know — retention with whoever runs the database, encryption with whoever runs the infrastructure, certifications with whoever holds the audit report — and delete the ones nobody can confirm. Done when every specific in the document traces to somebody who said it.

## Check this yourself

**Can you name a person who confirmed each specific claim in this document — retention periods, encryption, sub-processors, certifications?**

1. Read the document as a list of assertions about your own business.
2. For each specific, ask the person who would know: retention with whoever runs the database, encryption with whoever runs the infrastructure, certifications with whoever holds the audit report.
3. Delete every claim nobody can source. Invented SOC 2, ISO 27001 and HIPAA claims are the named ones.

*What wrong looks like:* A thirty-day retention period and AES-256 at rest arrive in the draft because they are plausible. The FTC treats a false privacy claim as a deceptive practice, so the consequence is an enforcement action rather than a rejection.

## Notes

Nothing in a registration reveals whether a claim was confirmed, which is why this cannot be settled here. The user has to read the generated document as a set of assertions about their own business and strike out everything they cannot personally source. Invented SOC 2, ISO 27001 and HIPAA claims are the specific ones the research names.