Trust
Trust center
This page lists what has and has not been independently verified. Items marked Not yet or Open are not in place. We will not describe an item as certified, compliant or attested until the evidence exists and has been approved for use.
Content last reviewed against product evidence on 2026-10-05.
Assurance status
| Area | Status | Detail |
|---|---|---|
| SOC 2 attestation report | Not yet | No SOC 2 audit has been completed and no report exists. We do not claim SOC 2 status. |
| ISO/IEC 27001 certificate | Not yet | No ISO 27001 certification exists. We do not claim ISO 27001 status. |
| Independent penetration test | Open | An independent assessment with no unresolved critical or high findings is a release gate (SEC-EXT-001) and is still open. No test report can be shared yet. |
| Privacy and data-flow review by counsel | Open | Engineering data-flow inventories exist. Counsel-approved privacy, terms and DPA documents do not yet exist; the pages on this site are drafts (gates COM-002 and COM-003). |
| Regional data residency (EU, US, APAC) | Open | Tenant placement by region is intended but not proven. No residency commitment is made today (COM-011). |
| Availability commitment | Draft | A 99.9% monthly availability target is drafted for the managed control plane. It is not approved, not measured and not offered as an SLA (COM-013). |
| Real-host connector acceptance | Open | Claude Code, Codex CLI, OpenClaw and OpenCode each have one real-host acceptance record (one host version, Linux x64, development build, scripted model). Cursor and VS Code have none. Acceptance on Windows, macOS, arm64, other host versions and a released build is not complete (COM-010). |
| Secure development practices | Self-reported | Automated unit and integration tests, type checks, linting, dependency overrides for known advisories and secret scanning are run by the engineering team. These are not independently audited. |
| Vulnerability disclosure | Draft | A disclosure policy and a security.txt file are published. Response targets are not yet approved or staffed; see the security page. |
What we can share today
- The security overview, data flow and subprocessor list.
- The per-connector limits, including known ways an action can bypass a hook.
- An engineering data-flow inventory and a limitations sheet, on request for an evaluation.
- A synthetic demonstration, clearly labelled as synthetic. It does not show detection effectiveness.
Ask for these through the sales contact. We would rather say "not yet" than stretch a claim.
What we cannot share yet
- An attestation report, certificate or penetration-test report, because none exists.
- Customer references or case studies. There are none to publish.
- A signed DPA, an SLA, or a regional residency commitment.
- Measured detection-efficacy or latency figures.