NicNac Systems
NicNac Systems builds and operates websites, software, automation, and practical AI for businesses and organizations. Engagements are scoped in writing before work begins.
One public record · Two brands
Know what works.
Know what doesn’t.
One public record for NicNac Systems and Mosaic. It explains what we do, what is actually working, what is still being built, how we handle client information, what things cost and where the limits are. A deployment is not treated as proof that a product works.
21public capabilities listed
8working today, with limits
6still in development
7not available or not verified
A · What we do
Two brands. One standard of proof.
Mosaic
Mosaic is a NicNac initiative and ministry practice for churches, ministries, and nonprofits. It is not presented as an independent legal entity unless a written agreement says so.
The relationship
Both brands share engineering and operating standards, but customer discovery, inquiries, and language stay separate. The same Transparency Center governs both.
B · What works today
Available now — with the limits stated.
“Working” means there is a live service or a tested local implementation. It does not mean every advertised capability, integration, or commercial term is available.
NicNac · Public directory
Working and verified
National market directory
Five hundred city pages, 35,053 ZIP pages, 29,648 place pages, 20 industry pages and state directories are live under /flagship/. Search and pagination are available in the ZIP, place and industry indexes. ZIP-team roster links read static JSON; no PHP API is exposed.
Limit: The directory is a planning and reference surface. It is not evidence of demand, a local office, a customer or a completed engagement. Live routing, CRM, scheduling, messaging, payments and AI intake are not connected. Coverage derives from public ZIP and place data; each page describes a delivery blueprint, not an operating local team.
Available · verified 2026-11-03 · owner Nic Patterson
Shared · Public information
Working and verified
Canonical Transparency Center
One public page for both brands, generated from the audit register and reviewed on a monthly cycle.
Limit: This page describes the public deployment and the evidence obtained through 3 November 2026. It is not a certification or a warranty. BEAM and the six-path workspaces remain local-only and are not public services.
Available · verified 2026-11-02 · owner Nic Patterson
NicNac · Website
Working with limitations
NicNac Systems public website
The NicNac public site is live over HTTPS and remains the public entry point for scoped project work.
Limit: Live deployment content can differ from the local source. Some legacy catalog figures and campaign shorthand are not evidence of an operational service. Use the written proposal, not the catalog, as the commercial record.
Available · verified 2026-11-02 · owner Nic Patterson
Mosaic · Website
Working with limitations
Mosaic public presence
Mosaic is live at nicnacsystems.com/mosaic/ and has a separate public workspace at mosaic.nicnacsystems.com/mosaic-ops/.
Limit: The two surfaces are not yet one source of truth. Their feature and pricing copy must be checked against this center; the local customer preview is a different build.
Available · verified 2026-11-02 · owner Nic Patterson
Mosaic · Planning tools
Working with limitations
Mosaic Sunday workspace
A free browser-local workspace for a Sunday audit, service pacing, volunteer coverage, room resets, meal planning, backup export, and print/PDF output.
Limit: Data saves in the browser. There is no shared cloud roster, SMS/email delivery, background-check verification, church database sync, or room-safety certification.
Beta · verified 2026-11-02 · owner Nic Patterson
NicNac · Service
Working with limitations
Scoped project delivery
Websites, applications, automation, and practical AI work are available as scoped projects with written acceptance criteria.
Limit: There is no standard service-level agreement, delivery guarantee, or published result. Each project depends on access, approvals, and third-party systems.
Available by written scope · verified 2026-11-02 · owner Nic Patterson
Shared · Security control
Working with limitations
Tenant and partner isolation controls
The local BEAM and Partner applications scope records to the signed-in organization and test cross-account access. Partner administration is role-gated.
Limit: These are loopback-only applications, not a public multi-tenant service. There has been no independent security review, and not every local app has MFA.
Implemented in local applications · verified 2026-11-02 · owner Nic Patterson
Shared · Internal control
Working and verified
Private audit register
A private register tracks feature status, evidence, findings, remediation, ownership, last verification, and whether a public summary is approved.
Limit: The register is not a public status page and does not publish internal findings. It is accessible only from the loopback Atrium service.
Internal · verified 2026-11-02 · owner Nic Patterson
C · What’s in development
Prototypes are labeled. They are not products yet.
These systems have real code or a real slice, but they remain local, partial, or dependent on an external authorization. No customer should plan around them as if they were generally available.
Shared · Application
Partially implemented
NicNac and Mosaic customer discovery
A local discovery experience with separate NicNac and Mosaic paths, deterministic demonstrations, and consent-based inquiry records.
Limit: Not published. It does not send email, create CRM records, book meetings, or process payments. The inquiry database is local and currently contains no customer inquiries.
Prototype · local preview · verified 2026-11-02 · owner Nic Patterson
Shared · Application
Partially implemented
BEAM human-augmentation workspace
A local workspace with scoped identity, guided reflection, a four-week plan, brand memory, and a real image-render queue.
Limit: Loopback-only prototype. No public sign-up, MFA, SSO, subscription, production TLS, or validated psychometric instrument. Image rendering depends on the local GPU.
Prototype · verified 2026-11-02 · owner Nic Patterson
NicNac · Application
Partially implemented
Partner Network
A local partner workspace for applications, allocation, prospect strategy, protected demonstrations, academy, and commission records.
Limit: Not publicly deployed. Commissions require an active partner, signed agreement, enabled jurisdiction, cleared funds, and provider-confirmed payout. No commission is earned from pipeline alone.
Prototype · local · verified 2026-11-02 · owner Nic Patterson
Shared · Internal application
Partially implemented
Acquisition Engine
A local research, pipeline, demonstration, proposal, and workflow-contract system. It records intent and evidence; it does not send outreach.
Limit: Internal only. No email, SMS, CRM sync, calendar booking, payment, or public customer portal.
Internal prototype · verified 2026-11-02 · owner Nic Patterson
Shared · Commerce
Dependent on external authorization or integration
Checkout, subscriptions, and payment processing
Stripe is the designated processor. No public checkout, subscription, entitlement, invoice, or payment flow is live.
Limit: Prices on a page are not a transaction. A written proposal or executed checkout terms govern any purchase. No card data is collected by the Transparency Center.
Dependent / not live · verified 2026-11-02 · owner Nic Patterson
Shared · Assurance
Partially implemented
Accessibility conformance
Public pages use semantic headings, skip links, visible focus, responsive layouts, and reduced-motion handling where implemented.
Limit: No WCAG conformance audit or assistive-technology test has been completed. This is not a claim of WCAG compliance.
Partially reviewed · verified 2026-11-02 · owner Nic Patterson
What is not available
No is part of transparency.
Mosaic · Product
Not implemented
Mosaic ONE connected platform
Mosaic ONE is a proposed connected home for church communications, giving, livestream, volunteers, and technology.
Limit: Not generally available. Integrations are in development; no church database, giving processor, livestream provider, or member record is connected.
Proposed / in development · verified 2026-11-02 · owner Nic Patterson
NicNac · Product
Not implemented
AI Receptionist
A proposed receptionist workflow for approved answers, intent routing, calendar truth, after-hours handling, and a call receipt.
Limit: A filed price exists, but there is no live telephony, calendar, CRM, model, or customer deployment behind it.
Proposed · verified 2026-11-02 · owner Nic Patterson
Shared · Integration
Not implemented
Email, CRM, calendar, and SMS integrations
The public sites can open an email or route a form to a local review queue. They do not automatically send email, create CRM records, book meetings, or send SMS.
Limit: Any live deployment with those integrations would require separate consent, processor review, credentials, and access controls.
Not implemented · verified 2026-11-02 · owner Nic Patterson
Shared · Product
Not implemented
Public client and customer portals
There is no public customer portal, client document vault, or self-service account area.
Limit: Existing authenticated applications are local prototypes. They are not offered as public client portals and do not contain public customer data.
Not implemented · verified 2026-11-02 · owner Nic Patterson
Shared · Operations
Not implemented
Production monitoring, backups, and disaster recovery
No public uptime SLA, verified production backup schedule, or tested disaster-recovery procedure is offered.
Limit: Local files can be copied, but a backup is not a verified restore. No claim is made about recovery time or recovery point.
Not verified · verified 2026-11-02 · owner Nic Patterson
Shared · Assurance
Requires additional security or legal review
Independent security and compliance review
No independent penetration test, SOC 2 report, HIPAA certification, PCI certification, or legal review of this page has been completed.
Limit: Local automated tests are evidence of specific behavior, not a security certification. Do not infer compliance from this page.
Not completed · verified 2026-11-02 · owner Nic Patterson
Shared · Security control
Requires additional security or legal review
Encryption at rest for local stores
Public traffic uses HTTPS. Encryption at rest for the local SQLite databases and uploaded files is not verified or claimed.
Limit: Local loopback and file permissions are not a substitute for encryption, key management, and access review.
Not verified · verified 2026-11-02 · owner Nic Patterson
D · What we do differently
Human judgment stays in the loop.
Human augmentation
Software should return attention and judgment to a person, not impersonate one.
Practical AI
We prefer a bounded, testable workflow over a broad promise. Deterministic demonstrations are labelled as demonstrations.
Human oversight
A person approves public content, client-facing output, and consequential decisions.
Privacy-conscious architecture
Collect what the work needs, keep it out of public web roots, and do not sell it.
Client control
Client-owned domains, data, and handover are the intended default; ownership terms belong in the written agreement.
Modular technology
We integrate the smallest useful piece rather than forcing a platform migration.
Transparent commerce
Published prices and written proposals take precedence over catalog shorthand. Internal partner compensation is not public pricing.
Responsible automation
No hidden outreach, no fabricated proof, no autonomous high-stakes decision, and no claim that a simulation is a live system.
E · How we protect clients
What is implemented — and what is not claimed.
This section describes controls that exist in the reviewed local applications or public configuration. It is not a certification. Gaps are listed beside the controls.
Public surface
The public sites are served over HTTPS. Public pages contain no customer database, inquiry export, or client file. The Transparency Center loads no third-party fonts, analytics, or advertising scripts.
Customer discovery preview
The local NicNac/Mosaic discovery app binds to loopback only. It uses an HttpOnly, SameSite=Lax session cookie, same-origin POST checks, request-size limits, rate limits, parameterized SQLite statements, and separate inquiry tables for each brand.
Authenticated applications
BEAM and the Partner Network are loopback-only local applications. They use server-side sessions and scope records to the signed-in organization. Partner administration requires an administrator role, and the Partner app includes CSRF checks, optional MFA, and an append-only audit chain.
Files and databases
Application databases and uploads sit outside the public web roots. Static file handlers enforce path containment, and arbitrary database paths are not served. Local SQLite files are not claimed to be encrypted at rest.
AI processing
Public demonstrations use synthetic data and deterministic scripts. The local BEAM image workflow can send brand text and art direction to a local ComfyUI renderer; it does not send the uploaded logo to the model. No public endpoint accepts real customer files for AI processing.
Logs and access
Local application logs avoid query strings; the Partner app hashes or truncates reviewed IP addresses. No public analytics package is installed on the Transparency Center. Hosting and edge providers still process standard request metadata.
Retention
The local customer preview states a 90-day retention policy for inquiry records. An automated deletion job has not been verified, so retention is currently a documented policy plus manual operation, not an automated guarantee.
Third parties
The public Mosaic site is delivered through Cloudflare, which processes standard request metadata at the edge. The local demos make no outbound calls. We do not claim that any third-party processor is certified for a regulated data set.
No customer information appears on this page.
We do not publish client names, contact details, inquiry records, uploaded files, partner referrals, commission rates, statements, credentials, or internal findings. Those remain in access-controlled systems or the private audit register.
F · Pricing and commercial transparency
Published schedule. Written scope. No surprise renewal.
| Offer | Published price | Status and terms |
|---|---|---|
| NicNac Core | $49/month months 1–3; $99/month months 4–12; $299/month from month 13; $499/month from month 25 | Ratified October 2026. October amendments and cancellation disclosures govern where they differ. Stripe is the designated processor; no public checkout is live. |
| Hardware | From $999 one-time | Ratified floor. Final configuration and availability are confirmed in writing. |
| Mosaic ONE Community Seat | $99/month | Filed price. Mosaic ONE as a connected platform is not generally available. |
| AI Receptionist | $1,850/month | Filed price. Not offered as a standard live service; any deployment requires a scoped integration and human escalation design. |
| Mosaic local Sunday workspace | Free | Browser-local tools using sample data. No cloud account or shared roster is included. |
| Mosaic Sunday Peace setup | $1,450 one-time | As published on the live Mosaic site. Scope and dates are confirmed before payment; travel and third-party subscriptions are separate. |
| Mosaic cloud pilot | Planned $49 / $99 / $199 per month | Interest list only. Not available for purchase; no subscription or trial begins by registering interest. |
| Other project work | Written proposal | No price on this page is a quote for custom work. Catalog figures that do not match this schedule are historical or proposed and are not authoritative. |
Terms that apply
- A written scope, price, acceptance test, and data boundary come before delivery.
- No subscription renews automatically until a checkout and subscription system is actually live and disclosed at purchase.
- Cancellation, refund, and renewal terms are those in the signed agreement or the checkout terms shown at purchase; this page does not replace them.
- Internal partner commission rates, statements, and referral economics are not public pricing and are not disclosed here.
- No result, revenue, headcount reduction, uptime, or search ranking is guaranteed.
No partner commission arrangement is published. Partner economics are governed by a separate written agreement and are not a customer price.
G · Limitations and responsibilities
What can go wrong — and who decides.
AI and automation
Models can be wrong, incomplete, or confidently incorrect. Generated images can distort architecture, text, and people. A person must inspect consequential output.
Simulations
Demos are deterministic simulations with synthetic data. They are not connected to a customer’s systems and do not prove a production integration.
Availability
No public uptime SLA is in force. Several applications are loopback-only prototypes, not hosted customer services.
Data and integrations
Email, CRM, calendar, SMS, payment, ChMS, and livestream integrations are not broadly connected. Each requires separate authorization, credentials, testing, and often a vendor review.
Customer responsibilities
Do not send clinical, safeguarding, financial-account, password, or other high-risk data through an inquiry form. Provide approved source material and name a human approver.
Security review
There has been no independent penetration test, SOC 2 audit, HIPAA certification, PCI certification, or legal review of these public statements. Do not treat this page as a certification.
H · Accountability
Ask. Correct. Escalate.
We would rather hear about a problem than have a customer discover it. These are the routes we can actually answer.
General and project questions
Use the subject line “Project question”.
Privacy or data request
Use the subject line “Privacy request”. Include the brand, the contact details used, and what you need. We may need to verify control of the record before acting.
Report a security or confidentiality concern
Use the subject line “Security report”. Do not include passwords, private keys, customer records, or exploitable details in the first message; ask for a safe channel.
Correct a public claim
Use the subject line “Transparency correction”. Name the page and the statement; we will review it against evidence.
Do not send secrets.
Never send passwords, private keys, full card numbers, clinical records, safeguarding details, or another person’s confidential information through an initial email. Ask for a safer channel first.
Status definitions
How to read every label.
- 1 Working and verified
- 2 Working with limitations
- 3 Partially implemented
- 4 Not implemented
- 5 Broken or unreliable
- 6 Dependent on external authorization or integration
- 7 Requires additional security or legal review
Last reviewed 2026-11-03. Next scheduled review 2026-12-03. The page is versioned; material changes require a new version and a new review date.
Version history
What changed, and when.
| Version | Reviewed | Change |
|---|---|---|
| 1.1 | 2026-11-03 | National market directory deployed at /flagship/ with 500 city, 35,053 ZIP, 29,648 place and 20 industry pages. PHP roster links replaced by static state JSON. Canonical Transparency Center published at /transparency. BEAM and six-path workspaces remain local-only. |
| 1.0 | 2026-11-02 | Initial canonical center. Public/private audit split. Local remediation of the live-site claim and third-party font findings. |