Security · Coverage · Portability
Exactly what is in scope, and exactly how you leave with it.
Precision is the product. A record that blurs what it witnessed against what it was told is not evidence, so this page draws every boundary in the same detail the receipts do.
Portability
How leaving works, written down before you join.
Export is a button, not a support ticket
Every receipt, in the canonical form it was signed in, plus the public key and the log proofs. Whenever you want, as many times as you want.
The verifier is open source and stays free
It runs offline, checks a signature against a published key, and has no idea whether you are a customer. That is deliberate: a verifier we could switch off would not be worth running.
Open formats the whole way down
RFC 8785 canonical JSON, RFC 9052 COSE signatures, RFC 9162 log proofs, RFC 3161 timestamps. Someone could write their own verifier from the specs, and we would consider that a good day.
Self-host and we never hold it at all
Same binary, your infrastructure, your signing key. There is nothing to migrate away from, because nothing was ever with us.
Coverage
Where the evidence is first-hand, and where it is not.
Evidence for your audit, not a certificate of ours.
No SOC 2 report, no ISO certificate, no third-party penetration test. We produce evidence an auditor can use. We are not ourselves audited, and we will never blur those two things to win a deal.
Every claim here is one you can check.
Nobody has measured our detection against any competitor's under conditions either of us would accept. Until somebody does, nobody here may say we are better at it.
Bedrock and Vertex: attested, never observed.
Both sign every request in a way that breaks when anything sits in the path. A callback in the Python SDK is the only vantage point that exists, and what it produces is attested, not observed.
Editors: the models you add, not the ones bundled.
In Cursor, Copilot and their peers, a base URL applies to models someone added with their own key. Whatever ships bundled goes to that vendor and no setting changes it. We never describe those editors as covered.
Configuration, not interception, with a coverage map.
We see what opts in. A native app with its own HTTP client or a hardcoded endpoint is invisible, and the coverage page in the product says so rather than hiding it.
The browser: four sites, attested.
The extension covers ChatGPT, Claude, Gemini and the Microsoft Copilot surfaces, and nothing else. It runs the gateway's own rules, and because the content stays in the browser its receipts say attested, never observed.
MCP: 33 of 62 vendor servers can be fronted.
The token a client obtains is bound to that server's own address and is refused when the request arrives from ours. Of 62 vendor servers we measured, 33 can be fronted and 22 cannot. We will not take custody of your OAuth tokens to change that number.
A card number is recorded, never substituted.
On a payment route, replacing a card number turns a valid charge into a decline that looks like the provider's fault. We log it and leave it alone. We are also not PCI certified, and say so in the same breath.
Agent: macOS, Linux and Windows; Windows warns until our certificate lands.
The device agent installs on all three. On Windows it warns until our code-signing certificate is issued. Everything else, gateway, receipts, verification, packs, is unaffected.
No password reset by email.
Recovery is by codes you hold. An account recoverable by whoever controls a mailbox is an account whose evidence is only as good as that mailbox, and that is not good enough here.
Seven frameworks, read control by control.
Of 600 controls assessed, 44 are ones a receipt contributes evidence to, never the whole of a control on its own. The other 556 are named in the same pack as out of scope, so an auditor sees the boundary rather than discovering it. A further thirteen frameworks sit in the control register without a receipt mapping.
What a reviewer can confirm independently.
Not assurances: facts with a source. Each one is in a public repository or a published specification, and each one stands on its own.
0
Third-party code in the signing path
The module that signs your evidence uses the Go standard library and nothing else. Continuous integration fails the build if a dependency appears. Read the go.mod yourself.
4
Open specifications, end to end
RFC 8785, RFC 9052, RFC 9162 and RFC 3161. Nothing proprietary sits between a receipt and the person checking it, so a receipt holds up on its own.
1
Rule that overrides every other decision
A receipt must never claim more than happened. Where a field could read stronger or weaker than the truth, it reads weaker, and a change that breaks this is rejected however convenient it is.
Security disclosures go to our published contact and are answered by a person. We do not run a bug bounty yet, and we will not pretend a form is a programme.security.txt
Boundaries drawn this precisely are what makes the rest of it hold.
The next step is checking a receipt, rather than taking any of this on our word.