An Accountability Institution for Technology Governance
Vordan publishes the analysis, builds the instruments, and sets the standard. The accountability gap is real. The institution closing it is here.
About
Technology has outpaced the institutions designed to govern it. The gap is not a temporary lag. It is a structural condition. Regulatory frameworks are written for systems that no longer resemble what is being deployed. Audit instruments measure compliance with standards built before the threats they assess existed. Accountability is invoked after failures, not designed before them.
Vordan exists to close that gap. Not by describing it, but by building the infrastructure that closes it. That means a publication that names failures honestly. It means instruments that measure accountability with rigor: the VAF for direct organizational assessment, the VEPA for external posture analysis, the AAB for the governance conditions created by autonomous AI. It means a doctrine that makes accountability a design requirement, not a post-incident response.
Vordan is the institution that sets the standard, conducts the assessment, and publishes the record. Founded in April 2026 by Dominick Costa, a New York-based GRC practitioner and operations leader.
Vordan operates across three layers. The publication: the Accountability Report and Gap Alert: covers the failures that define the gap. The instruments: the VAF, VEPA, and AAB: measure accountability at organizational depth, external posture, and agentic AI governance. The doctrine: Accountable by Design: is the standard that underlies all three.
These are not separate products. They are the architecture of a single institution built on the conviction that accountability is an engineering problem, not a communications problem. It requires deliberate design, not documentation.
The Doctrine
The Vordan Doctrine identifies the six structural properties that every accountable governance system must possess. These properties are the foundation on which every Vordan instrument is built. The VAF, VEPA, and AAB each operationalize the Doctrine differently: different subjects, different evidentiary depths, different outputs. The Doctrine is the why. The instruments are the how.
01
Every system, decision, and output must have an identifiable and accountable source. When origin is obscured by offshore incorporation, distributed architecture, or delegated execution, the accountability chain breaks before it begins.
02
The parties most affected by a governance failure must have a mechanism to be heard before the decision is made, not after the damage is done. Governance without voice is administration.
03
Every decision, action, and output must be traceable to an accountable owner through an unbroken audit trail. Without traceability, accountability is performative. The log must exist, persist, and be independently verifiable.
04
The dangerous window is not ignorance. It is the gap between when a threat is known and when protection is complete. Governance that operates on annual cycles against threats that move in hours is structurally misaligned.
05
Identifying a gap without a defined response mechanism is observation, not governance. The accountability loop is only closed when the parties who find a problem have the authority, the pathway, and the architecture to fix it.
06
Accountability requires a public record. When the gap between what happened and what was disclosed is itself ungoverned, the accountability architecture fails at the final layer. Transparency is not a communications strategy. It is a structural requirement.
Glossary
Precision of language is a governance property. Vordan maintains a working glossary of terms used in the publication. These are not standard definitions. They are the definitions that matter for practitioners operating inside the accountability gap.
The Publication
Vordan publishes on Sundays and when the intelligence warrants it. The Accountability Report is the full analysis: one governance failure examined thoroughly. The Gap Alert is the urgent signal: something just happened, here is why it matters before the memo arrives.
One governance failure examined thoroughly. The full analysis: what happened, what the structure above it allowed to happen, and what closing that gap would actually require. Not a briefing. A reference.
Read the reports →Breaking intelligence on accountability failures as they happen. Something just broke, was disclosed, or was quietly buried. Here is the structural gap it exposes, before the memo arrives and the framing hardens.
Read the alerts →Builds
Vordan does not only name gaps. It closes them. The builds documented here emerge directly from the analysis, products and tools designed from the ground up on the Accountable by Design doctrine.
Every encrypted email provider, no matter how strong its encryption, operates under the laws of the country it is headquartered in. Metadata (IP addresses, device fingerprints, recovery emails, payment records) is never encrypted. No private email company can refuse a valid legal order in their jurisdiction. The encryption holds. The institution above it is a different question entirely.
AfterMail is built on sealed sender architecture at the protocol layer. No user identifiers. No phone numbers. No email addresses. No account linked to any real-world identity. The relay never knows who is sending. Nothing to compel because there is nothing to hand over. The interface looks and feels like email. The architecture underneath it does not resemble email at all.
Built in Rust by a single founder. Beta is live. Invite-only access via waitlist at aftermail.co.
The VAF assesses organizational accountability from inside, through direct access, practitioner interviews, and evidence production under defined timeframes. The VEPA assesses external posture from the public record alone, requiring no organizational cooperation. The AAB defines what sufficient accountability looks like for autonomous AI deployments.
Together they constitute a complete accountability measurement architecture. No instrument duplicates another. No gap between them is accidental. Each is built on the Vordan Doctrine and produces findings that hold under scrutiny.
The Publication
Every Sunday and when the intelligence warrants it. No noise. No vendor content. Analysis written for the people who have to act on it.
Free to start. Written for practitioners.
Contact
Vordan is written by Dominick Costa, a New York-based GRC practitioner, cybersecurity analyst, and operations leader. For editorial inquiries, speaking, or governance readiness conversations, reach out directly.
Vordan offers pre-audit governance readiness assessments and post-audit accountability gap reviews for organizations that want to close the gap before the failure, not after it.
Inquiries are handled directly and confidentially.