AI9OS Founder Philip Choo on Building Reliable Evidence Validation SaaS

July 2026. I ran a citation audit over a case bundle days from reaching counsel. 282 claims, each checked back against the exhibit it rested on. 64 came back flagged. An independent second pass confirmed 63 as real defects, 17 of those critical, and rejected one false alarm. The bundle was not sloppy. Most of it was AI-assisted research and it read beautifully. That was the problem. Nearly every defect was a claim that sounded settled and was not, a tentative guess about an identity written up as confirmed, a client's own untested account cited as though it were a police file. Fourteen of them sat in one document alone. If that had reached opposing counsel, the whole bundle goes, and so does the client's case. I sat with that for about a week. I did not want a faster research tool after that. I wanted one that could not hand me a confident answer without showing me what it stood on, and that would never call something confirmed on its own.

Worked, writing down the law. I published a walkthrough of the three PDPA lawful bases an investigator can actually rely on, and a breakdown of exactly where lawful people-finding crosses into a POHA doxxing offence. Those two beat every product post I have written, 81 and 82 impressions against 31 and 40. Practitioners do not want to read about my software. They want the answer to the question they are already stuck on at 11 pm, and if you answer it properly they go and look at who wrote it. Flopped, leading with white-label. Run more matters under your own brand, without hiring a research team. It is a real capability, and it landed on nobody. I was selling convenience to a profession that buys defensibility, which is close to the opposite pitch. I pulled it out of the headline entirely and put case acceptance there instead, which is the thing that actually separates one agency from another. It now appears in exactly one sentence, with the qualifier attached, and nowhere near the top.

Two things, and both of them are me saying no. Bank records. Asset tracing clients want balances. I cannot get them, not in Singapore and not in Malaysia. They come out through court discovery, via their solicitor. In matrimonial work, this comes up every single time, usually inside the first ten minutes. Accounts. She has a Facebook and an email; can you get into them? Often, the client already has the password and is offering it across the table. Public content only. No login, no pretext, no friend request, and no; I will not take the password. I stopped treating these as objections to be handled on a call and wrote them into the intake pack instead, in plain language, before anyone signs anything. The client reads the limit and initials it. That moved the awkward conversation from week three, after they have paid, to day one. Fewer people say yes. The ones who do are the right ones, and the matter runs cleaner from there.

That the bottleneck is finding things. It is not. Open-source collection has been cheap for years, and AI made it close to free. Anyone can produce a hundred pages by lunchtime. The bottleneck is deciding what you are willing to put your name to in an affidavit. Almost every vendor sells collection speed. Very few sell the part where a finding is promoted from probable to confirmed, because that part is slow, unglamorous, and cannot be fully automated without lying about it. The related mistake is treating integrity as the finish line. A hash-chained evidence locker proves nobody altered the artifact after I collected it. It says nothing at all about whether the artifact was true when I found it. A perfect chain of custody will faithfully preserve a forgery, and in 2026, forgeries are cheap. Integrity is the floor. Judgment is the ceiling, and the ceiling is where this profession actually lives. Buyers who understand that ask completely different questions on the first call.

Prefer to continuously monitor and improve what we have already built, rather than pile more on top of it. It runs a matter end to end with 26 test suites behind it, so the honest work now is hardening, not features. The gap is not capability. It is that almost nobody outside my own network has heard of it. Zero external sites link to mine, so nine published articles rank for nothing. So, get in front of the Singapore association bodies, run real matters alongside a small number of selected agencies, watch where the platform strains under real weight, and fix exactly that.

282 claims audited on one bundle, 63 real defects caught.

Twenty years in security and investigations before any of this got written. I ran operations with 800 to 1,200 personnel across oil and gas, banking, data centres, pharmaceutical, embassies, and government facilities, and the results I got there came from replacing manual processes with technology, 40 percent less manpower, 25 percent lower cost, 30 percent less attrition. At Woh Hup, I proposed and saw through a central command centre covering sites in two countries. I am a licensed private investigator in Singapore, so I am building for a job I still do myself. What I was not is a software engineer. I had never shipped a product. All of that I learned on this one, mostly by getting it wrong first.

I wrote a script to check that the live site matched what I had uploaded, and for months it printed a clean pass. Then I looked at what it was actually comparing, blog pages only. Not the homepage, not the demo, not the machine-readable summary. The three pages that mattered most had never been checked, and it had never once told me so. It had been reporting green while the homepage was serving a stale version. A check that cannot tell you what it did not look at is worse than no check because it sells you confidence you have not earned. Every guard I write now prints its own blind spot, and I test that it can still fail.