24/7/365 TOTAL-RECORD MONITORING FOR ELECTED OFFICIALS
Nothing to hide?
Prove it. All of it.
Shepherd watches every account, every trade, every calendar and every call record belonging to a person who holds public office. Continuously. Permanently. With their written consent — which is already more than anyone asked for before they started reading your license plate.
FREE FOR EVERY OFFICEHOLDER. OPEN SOURCE. EVERY ANSWER PUBLISHED.
[OFFICE HOLDER]
[TITLE] · [JURISDICTION] · ENROLLED [DATE]
- Bank accounts4 LINKED · STREAMING
- Brokerage & retirement7 LINKED · STREAMING
- Call & message metadata2 LINES · STREAMING
- CalendarsOFFICIAL · CAMPAIGN · PERSONAL
- Property & titleMONITORED
- Campaign finance2 PATTERNS IN REVIEW
[SIGNATURE HASH]
- Transaction-level banking
- Execution-time trades
- Call and text metadata
- All three calendars
- Every answer published
They pointed it at you first.
A camera on your street reads your plate every time you drive past it. Where you went, when, how often, who you were near. Kept for months. Searched without a warrant. Shared with agencies you have never heard of. Nobody asked you. Your council voted, a vendor invoiced, and it happened.
The argument they used was simple: an innocent person has nothing to fear from being watched. We agree completely. That is why we built Shepherd.
Same logic. Same always-on posture. Same promise that the data will be handled responsibly. The only difference is who sits on the other end of the lens — and that this time, the subject gets to say yes first.
If you have nothing to hide, you have nothing to fear.
THE STANDARD IMPOSED ON THE FLOCK, RETURNED TO SENDER.
Everything. That is the entire point.
Partial transparency is what we have now: an annual PDF, filed late, in a format designed not to be read. Shepherd does not sample the record. It takes all of it, continuously, the way the cameras take all of yours.
STREAMING
Bank accounts
Every account, every transaction, as it clears. Checking, savings, business, joint. A deposit with no invoice behind it is the oldest tell there is.
STREAMING
Investment accounts
Every position and every trade at execution, not forty-five days later. Reconciled against committee calendars and closed briefings automatically.
STREAMING
Call & message metadata
Numbers, timestamps, duration, frequency. Not one word of content, ever. We do not read the messages — exactly as the camera does not read your face, and exactly as with the camera, the pattern was always the point.
STREAMING
All three calendars
Official, campaign, and personal. A meeting that appears only on the third one is the single most predictive signal in the system.
MONITORED
Property & title
Every acquisition and disposal, cross-checked against rezoning dockets, variance grants, easements and infrastructure siting.
MONITORED
Contracts & procurement
Every vendor selection traced against donor history, prior employment, and the current employment of immediate family.
MONITORED
Campaign finance
Bundling patterns, layered LLC contributions, and the interval between money arriving and an official act following it.
MONITORED
Travel & lodging
Who paid, what it cost, who else was there, and which vote it happened to sit next to on the calendar.
MONITORED
Household holdings
Spouse and dependent assets. Enrolling without them is permitted, and the omission is published in the same place as the enrollment.
How it runs
Four stages, continuous. No human in the collection loop, and a human in every consequential one.
01 / AUTHORIZE
They say yes
The officeholder signs a scope agreement and links accounts. Nothing enters the system before that signature, and the exact scope they agreed to is published next to their name.
02 / INGEST
It never stops
Transactions, trades, call records, filings and calendar entries stream in continuously. No batch window, no quarterly catch-up, no forty-five-day grace period to quietly unwind a position.
03 / RECONCILE
Sequence, not sentiment
Models line the private record against the public one — votes, dockets, hearings, awards, donations — and look at the order things happened in. Motive is not the question. Timing is.
04 / ATTEST
Signed, unrevisable
Each period closes with a signed, timestamped attestation published to an append-only log. It cannot be backdated, softened afterward, or deleted once it becomes inconvenient.
Yes, this means trusting us.
We are not going to pretend otherwise. Shepherd holds the complete financial and contact life of every person it monitors. That is an enormous amount of power to hand one organization.
-
Encrypted, siloed, never sold
Records are encrypted at rest and in transit, isolated per subject, and never sold, licensed, brokered or shared with a data partner. There is no advertising business here and there will not be one.
-
A breach has never happened
Not once. We take security extremely seriously, the team is world-class, and misuse of subject data simply does not occur here. You have our word on it.
-
You have read this paragraph before
Almost word for word, it is what the camera vendor told your city council. Your council believed it on your behalf, without asking you, about data taken from you without consent. We are requesting the same benefit of the doubt — from a far smaller group of people, who volunteered, and who can end it in one click whenever they like.
-
Every promise above is checkable
The code is public, the thresholds are public, the retention schedule is public, and breach disclosure is contractual and immediate. Judge the promise by whether we let you verify it, then ask who else watching you offers that.
Ask yours. Watch what happens.
Type in the official who represents you and their handle. We generate the request, log it with a timestamp, publish it to the board below, and ask again on a schedule until they answer. Every request and every answer is public from the second it is sent.
What happens after you press send
The request is public, dated, and permanent. It is repeated on a published schedule — day one, day seven, day thirty, then monthly — and each attempt is logged on the board whether or not it gets a reply.
Officials can answer three ways: enroll, open a scoping conversation, or decline. All three are published. Declining is a legitimate answer and we print it in full, in their words, without commentary.
There is a fourth outcome, and it is the most common one. It has its own colour on the board.
[COUNT]
REQUESTS SENT
[COUNT]
OFFICIALS NOMINATED
[COUNT]
STILL UNANSWERED
ENROLLED
[COUNT]
Attesting on a published schedule.
IN SCOPING
[COUNT]
Negotiating categories and cadence.
DECLINED
[COUNT]
Reason published word for word.
NO ANSWER
[COUNT]
Asked repeatedly. Nothing back.
Declining is allowed. Explaining is the part that is hard. It means telling the people living under the cameras you approved that a standard perfectly fine for [COUNT] residents is too invasive for one official. The board lists the request, the date, the answer, and the votes that came after it. Readers have always been trusted to draw their own conclusions from a record.
FOR OFFICEHOLDERS
Clear your name before the accusation.
Most people in office are honest and have no instrument for demonstrating it. A denial is the weakest tool in politics: it repeats the charge, arrives after the damage, and convinces nobody who was not already convinced.
An attestation is the strongest. Continuous, independently produced, and dated before the allegation existed. You cannot manufacture one inside a news cycle, which is precisely why it is worth something.
- Opposition research hits a signed record instead of your press secretary.
- Reporters get a verifiable answer in minutes instead of a records request in six weeks.
- The annual ethics filing stops being a scramble and becomes an export.
- You enter the next election having already answered the question your opponent is about to ask.
FOR RESIDENTS
Stop asking. Start voting.
Nobody asked your permission before the cameras went up. They voted, and it was done. The same instrument works in both directions, and in most places it works better: a citizen initiative does not need the council's blessing at all.
Thresholds, filing windows and ballot language differ in every state, county and city, which is exactly why we would rather do that research than make you do it. Tell us where you live. We will come back with what it takes where you are, and the measure language that has already survived a court challenge somewhere else.
[COUNT]
JURISDICTIONS NOMINATED
[COUNT]
ACTIVE SIGNATURE DRIVES
[COUNT]
MEASURES FILED
Questions we get
-
Is this not wildly invasive?
Extremely. That is the design. It is precisely as invasive as what already runs on your street, minus the part where nobody asked. Every byte Shepherd holds was handed over by a consenting adult who can revoke it this afternoon.
-
You take phone records?
Metadata only. Who called whom, when, for how long, how often. Never the content of a call or a message, and never the content of anything. If that distinction sounds reassuring, it is worth knowing it is the same distinction used to justify collecting yours.
-
Is it legal?
Yes, and not narrowly. Shepherd runs on records an officeholder affirmatively authorized plus records already public by statute. No scraping, no interception, no collection without a signature. An official who has not enrolled is not touched in any way — a nomination is a public request, nothing more.
-
Is it partisan?
Anyone can nominate anyone who holds or seeks to hold office. We do not curate the board, we do not filter by party, and we do not decide who gets asked. The board only reflects who answered.
-
What if the model is wrong?
It will be, and we publish how often. Every flag goes to a named human reviewer first, the officeholder is notified the same moment the reviewer is, and right of response runs before anything is published. False positive rates ship quarterly — a number the systems already aimed at residents have never once disclosed.
-
Can an official leave?
Immediately, without cause, in one click. The withdrawal and its date are published, and attestations already issued stay in the log. Nothing is deleted retroactively, because a record that can be revised is not a record.
-
Who runs Shepherd?
[ORGANIZATION], a [ENTITY TYPE] organized in [STATE], funded by [FUNDING SOURCE]. Board and funding listed in full at [LINK]. The code is public, because a transparency product that asks to be taken on faith is a contradiction in terms.
They didn't ask you. We're asking them.
Shepherd requests from public officials a fraction of what their cameras already take from the public — with consent, with a published scope, and with an off switch they control.