Self-applied audit · 2026-05-17

We built the framework.Then we ran it on ourselves.

The Six-Point AI Vendor Audit is a diligence framework any CPA can run on any AI vendor pitching them software. It applies to us too. Below: how Helmstead scores against each of the six checks, with public evidence and a do-it-yourself verification path for every claim.

3 Pass2 Not applicable1 In progress

Plat I · Check 01PASS

Track-Record Substantiation

What the check looks for

Cross-reference the vendor’s leadership bios against SEC EDGAR filings, state Secretary of State records, and verifiable professional history. Disambiguate same-name lookups before drawing conclusions.

Helmstead’s result

Helmstead is built by MDN Solutions LLC (Wyoming). MDN Solutions and its founder do not appear in SEC EDGAR — we are not a public reporting company and no individual associated with Helmstead is currently subject to public-company reporting obligations. Founder bio is verifiable via LinkedIn and the Wyoming Secretary of State business filing. We have no acquisitive history involving any publicly-filed transaction; if you are checking for an “8-K named the founder” signal, you will find none because there is no such 8-K.

Verify for yourself

Search EDGAR at sec.gov/edgar (no result expected). Search Wyoming SoS at wyobiz.wyo.gov for MDN Solutions LLC. Cross-reference founder bio on LinkedIn against public statements made on this site.

Plat II · Check 02N/A

Patent Claims

What the check looks for

USPTO Patent Assignment Search with assignee disambiguation — not just same-name lookups — against any specific patent or pending patent the vendor claims.

Helmstead’s result

Helmstead claims no patents. There is no patent-pending statement on this site, in our pricing, in our pitch deck, or in any sales material. There is nothing to verify because we make no claim. Our moat is execution velocity and network depth, not IP defense.

Verify for yourself

Search assignment.uspto.gov for “MDN Solutions” or “Helmstead” — you will find nothing, because there is nothing.

Plat III · Check 03N/A

Performance & Investment Claims

What the check looks for

Form ADV + CRS publicly visible? Arbitration clauses disclosed? FINRA/SEC registrations match named individuals running the trading or investment-advisory activity? Performance numbers tied to verifiable accounts?

Helmstead’s result

Helmstead is software-as-a-service for entity formation, fundability tracking, and credit building. We are not a registered investment adviser, broker-dealer, or trading platform. We make no performance claims and have no Form ADV obligation. This check does not apply to Helmstead because we make no claims that would trigger it.

Verify for yourself

Search SEC IAPD at adviserinfo.sec.gov for “MDN Solutions” or “Helmstead” — no result expected, because we are not an investment adviser.

Plat IV · Check 04IN PROGRESS

Legal Pages on the Deployed Surface

What the check looks for

Privacy policy, Terms of use, and a real business address visible on the deployed site. Absence of any of these is a flag.

Helmstead’s result

Partly closed, honestly. Privacy and Terms pages are now live and linked from the footer of every page — we caught that gap while applying the framework to ourselves and shipped both. The one piece we have not done is print a street address on the site: we operate as a remote Wyoming LLC and publish a contact email (privacy@ and legal@helmstead.app) instead. Our registered business details are public record at the Wyoming Secretary of State. Because the framework asks specifically for a visible business address, we still count this check as in progress rather than a clean pass — and we would rather tell you that than round up.

Verify for yourself

Look at the footer of any page on helmstead.app — the Privacy and Terms links are now there and resolve. Search wyobiz.wyo.gov for MDN Solutions LLC to confirm the registered entity; note a street address is not printed on the site itself.

Plat V · Check 05PASS

Structured-Data Integrity

What the check looks for

Does the site’s JSON-LD include an aggregateRating block? If yes, is the rating backed by a verifiable review corpus, or fabricated to feed Google rich-results display?

Helmstead’s result

helmstead.app publishes no JSON-LD aggregateRating block. We have no public review corpus to cite, so we make no rating claim that could be fabricated. View source on any page — the structured data is limited to standard Organization and WebSite schema describing what the site is, with no review metrics asserted.

Verify for yourself

On any helmstead.app page, view-source and search for “aggregateRating” — no match. Or run the page through search.google.com/test/rich-results — no Review/AggregateRating block reported.

Plat VI · Check 06PASS

Tech-Stack Disclosure

What the check looks for

What does the deployment actually look like in the HTML? Lovable.dev / Bubble / Webflow signatures indicate a no-code wrapper. A real engineering surface should be inspectable and consistent with the vendor’s claims about what they built.

Helmstead’s result

Helmstead runs on Next.js 15 App Router, hosted on Vercel, with a Postgres database (Supabase) accessed through Prisma. Authentication via auth-kit on top of Supabase Auth. Tailwind CSS for styling. The codebase is TypeScript-strict. No Lovable, no Bubble, no Webflow. Anyone who knows how to view source can verify the framework signatures (Next.js HTML markers, hydration payloads, app-router routing).

Verify for yourself

View source on any helmstead.app page. Look for the Next.js __next_data__ hydration script. Run builtwith.com on helmstead.app — result will list Next.js, Vercel, Tailwind. No no-code-builder signatures will appear.

See something wrong? Tell us, in writing.

We commit to a public correction within seven calendar days of any substantiated error in this self-audit. Send specifics, with sources, to corrections@aivendoraudit.org. Every correction we make is logged on the framework site.

Run the framework on a vendor →Start with Helmstead Free