Skip to main content

Exhibit B · Maysville

Counsel-gated communications system for a $7B data center

The communications site and constituent system for a $7 billion, 180 MW data center, built so in-house counsel reviews every public word before it goes live.

Client
Rumble (NASDAQ: RUM) and Northern Data AG (now Quake AI), through RUM Group, Inc.
Role
Principal strategist; sole builder and technical custodian
Dates
May 2026 to present
  • Next.js 16
  • React 19
  • TypeScript
  • Prisma 7
  • Cloud SQL Postgres
  • Auth.js
  • Resend
  • Zod
project value
$7B
expandable from 120 MW
180 MW
tests
~1,030
findings closed
107

Context

Context

Rumble acquired Northern Data AG in a roughly $767 million cross-border transaction that closed at the end of June 2026. One acquired asset is a data center project in Maysville, Georgia (population about 2,100): 63 acres, two 125,000-square-foot buildings, 120 MW expandable to 180 MW, a stated project value of about $7 billion, the company's largest U.S. development. The project faced organized local opposition and two of five councilmembers seeking rescission of its conditional use permit.

Schematic, drawn to area scale: two 125,000-square-foot buildings on a 63-acre parcel; 120 MW expandable to 180 MW.
01Privacy

Setting the privacy posture with counsel

June 12, 2026 proposal to Rumble legal: collect only what a visitor submits plus the submitting IP; no analytics, no pixels, no cookie banner. Counsel adopted it.

Gleb removed an already-built analytics layer and rewrote the privacy notice and terms to describe exactly what the code did.

Arrives

Collected

  • Analyticsalready built, removed
  • Pixels
  • Cookie banner
  • What a visitor submits
  • The submitting IP
What a visitor submits and the submitting IP pass into the record. Analytics, pixels, and a cookie banner stop at the gate.
02Data Rights

Data-subject rights machinery

  • privacy@ mailbox routed into a tracked Privacy queue
  • One-action deletion of a contact and all their data
  • An append-only privacy audit log with no relation to the contact, so the trail survives the deletion it documents
  • CSV exports with formula-injection neutralization
One action deletes a contact and all their data. The append-only privacy audit log has no relation to the contact, so its record of the deletion survives.
03Email

Email compliance

  • Server-enforced opt-in and agreement checkboxes
  • RFC 8058 one-click unsubscribe
  • CAN-SPAM footer
  • Double opt-in built

RFC 8058List-Unsubscribe-Post: List-Unsubscribe=One-Click

04Security

Security reviews

Three reviews, dated, with the headline fixes:

  1. June 144242 found, 11 critical/high fixed before launch
  2. September 183434 confirmed, all fixed
  3. September 203131 confirmed, all fixed same day
Closed107

42 + 34 + 31 = 107 findings closed

Findings by review: June 14, 42 found, 11 critical or high fixed before launch; September 18, 34 confirmed, all fixed; September 20, 31 confirmed, all fixed same day. 107 findings closed.

Headline fixes

  • An atomic claim replacing a race that could double-send to the whole list
  • A shared-password break-glass login deleted
  • PII exports behind a per-request active-admin check
  • CSRF, body-size caps, database-backed submission caps, HTML escaping in outgoing branded email, webhook signature verification, security headers site-wide
05Publishing

Legal-gated publishing

  1. Step 1Draft
  2. Step 2Preview
  3. Step 3Review link(revocable, hashed token)
  4. Step 4Publish or Schedule(Eastern time)
  5. Step 5Live(locked read-only)Read-only

Audit log

  1. 01Draft
  2. 02Preview
  3. 03Review link
  4. 04Publish or Schedule
  5. 05Live
Draft, Preview, Review link, Publish or Schedule, Live. Every step writes an audit-log entry; Live is locked read-only.
  • 85 editable public-copy fields in named draft versions
  • Revocable, hashed review links for counsel
  • Publish or schedule in Eastern time
  • Live drafts locked read-only
  • Hidden pages return 404 until an audited toggle
  • Test submissions flagged so counsel can exercise forms without contaminating results

The About page went through five counsel-reviewed versions.

06Research

Research pipeline

About 99 city meetings from 2022 to 2026, scanned images OCR'd, classified into excerpts, aggregated into a ten-part findings dossier and client memoranda.

  1. 99 meetings, 2022 to 2026
  2. OCR, then excerpts
  3. Ten-part findings dossier
  4. Client memoranda
About 99 city meetings, scanned images OCR'd, classified into excerpts, aggregated into a ten-part findings dossier and client memoranda.
07Land Use

Land-use and open-government analysis

The conditional use permit red-teamed against the six-month commencement clause, notice defects under O.C.G.A. 36-66 (with a live county rescission as precedent), the 30-day certiorari deadline under O.C.G.A. 5-4-1, vested rights, assignability across the change of control, and scope attacks on square footage.

The Open Meetings Act (O.C.G.A. 50-14-1) analysis shaped how the client engaged the council: one-on-one meetings and a noticed public town hall, with no private quorum and no serial walking quorum.

The Georgia Recall Act (O.C.G.A. 21-4) assessed as an escalation risk.

Every conclusion labeled strategic analysis for confirmation by Georgia land-use counsel.

08Judgment

Judgment calls

  • Refused a future date on a legal page
  • Implemented two conflicting counsel positions three months apart and documented both
  • Deferred a launch-eve security change with a written decision record
09Commits

Commit heatmap

220 commits, June 5 to September 24, 2026

220 commits, June 5 to September 24, 2026
Week ofCommits
Jun 5128
Jun 1237
Jun 1913
Jun 262
Jul 30
Jul 100
Jul 170
Jul 2418
Jul 310
Aug 70
Aug 147
Aug 210
Aug 283
Sep 40
Sep 114
Sep 188