Claims

Everything we say — and exactly what backs it.

Honesty is the product. This page lists what is proven, what we say only with a qualifier, and what we deliberately do not say yet — with the unlock condition for each. Every number is computed from the live scanner registry, never a hand-maintained literal.

01 · The numbers

Computed, not recalled.

Audited at commit d63fe404 · Claims Card v3 · September 12, 2026. Detector counts are enumerated from the live registry at build time; a drift test fails the build if any count diverges.

474detectors across AWS, GCP, Azure, GitLab and Bitbucket● computed live
589detectors registered across all platform integrations● computed live
28connector types● computed live
65integration tiles● computed live
696finding types in the catalogaudited constant
8Policy Intelligence Engine stagesaudited constant
180semantic contractsaudited constant
272pre-validated fix templatesaudited constant
02 · Say freely

Proven.

Every statement here is backed by code, a signed artifact, or an emulator-verified control — say it plainly.

Scope and scale

  • Detectors across AWS, GCP, Azure, GitLab and Bitbucket — the headline count is computed from the live scanner registry at build time, never a hand-maintained literal.
  • A larger set of detectors registered across every platform integration (the all-platforms total), with GitHub counted as a fix-delivery code host.
  • An open-source oidc-audit CLI (MIT) and a trustfix-action for CI.

Fix engine

  • Deterministic first: fixes come from certified synthesis or validated templates; an AI fallback with a numeric confidence is used only when no deterministic path exists; the engine fails closed to “Review required”.
  • For the OIDC and IAM trust-policy family on AWS — missing subject condition, overly broad trust, insecure StringLike, fork-PR risk, wildcard environment, admin trust — and for seven GCP public-binding types, a fix reaches “✓ Proven correct” with a signed receipt.
  • Proven fixes ship as native GitHub pull requests. GitLab, Bitbucket and Azure DevOps: preview.
  • A deterministic delta check blocks any fix that widens access; an SMT non-broadening certificate is attached to certified fixes.
  • Every fix button states the outcome: “Open proven fix” / “Open reviewed fix” / “See guidance” / “Needs input” — never a generic “Fix”.

Proof layer

  • A per-tenant Ed25519-signed, SHA-256 hash-chained ledger with RFC 6962-style Merkle inclusion proofs and signed tree heads.
  • Signed OSCAL 1.1.2 assessment-results packs, signed SOC 2 evidence bundles, signed Board Brief JSON packs; an OCSF 1.3 event feed with SIEM push; SARIF from the CLI and the Action.
  • Receipts verify offline with our open verifier, from source.

Agents

  • Agent Passports are W3C Verifiable Credentials 2.0 (DataIntegrityProof, eddsa-jcs-2022, did:key), verifiable offline, with revocation via a status list and a signed A2A agent card.
  • A default-deny MCP gateway whose every allow/deny decision is sealed to the ledger and can be re-derived by an auditor from the sealed record.
  • Delegation chains are checked for narrowing with a counterexample on refusal, with an honest split between mediated hops (enforced) and observed hops (recorded).

Enterprise

  • SSO (SAML 2.0 and OIDC), SCIM 2.0 provisioning, four-role RBAC, exportable audit log, application-layer tenant isolation, envelope encryption via KMS, a DPA, a security questionnaire, a sub-processor list and a security whitepaper — all emulator-verified.
  • No SOC 2 certificate is held; no third-party penetration test is on record yet. We say so before you ask.
03 · Say it this way

Checked.

True with a qualifier. These are the exact words to use — the qualifier is part of the claim, not a footnote.

Narrowing proofEvery fix is checked to only narrow access: a deterministic delta check blocks widening; a Z3 narrowing check is attached, advisory by default.
DelegationDeterministic narrowing check with a counterexample on refusal; an SMT-LIB artifact is attached; a Z3 implication check runs for condition-bearing hops (none reached in the shipped dataset); broader solver engagement is on the roadmap.
Status listTwo conformant, third-party-verifiable revocation lists over the same set: an IETF Token Status List (draft, RFC 1950 zlib framing) for JWT consumers, and a real W3C BitstringStatusListCredential (GZIP + multibase encodedList, eddsa-jcs-2022) for the Agent Passport credentialStatus.
MonitoringOn-demand and scheduled scans — the scheduler ticks (scan, report, retention, access-expiry) are now wired into the deploy; the live cadence confirms once the tick secret is set and ticks are observed in the logs.
ConnectorsAll connectors built and integration-tested against emulators; AWS and GitHub tested against real tenants. GitHub is read-only for discovery and additionally opens remediation pull requests (a scoped write) — never a broader grant.
Console accessThe console is invite-only: there is no self-serve signup anywhere — an account is created only by consuming a single-use operator invitation. In production, access is further restricted to named operator emails via Cloudflare Access (Zero Trust) once the DNS/Access Terraform is applied.
Cross-model reviewA second model reviews every fix — available on request; not enabled by default.
Fix outcomesProven fixes for the OIDC/IAM trust family; reviewed fixes for more finding types; guidance for the rest — the outcome is always on the screen.
Fix proofProven fixes ship as pull requests with a signed receipt and a certified diff (an SMT non-broadening certificate) that verify offline with our open verifier — no TrustFix account needed.
Agent gateEvery allow/deny decision of the default-deny MCP gateway is sealed to the signed ledger, and delegated authority is checked to only narrow at every mediated hop (observed hops are recorded, not enforced).
On-prem sensorA read-only on-prem sensor with no command channel: every time it starts, before it collects, it proves each enabled source is read-only (each credential-bearing source must refuse a write probe; the log and MCP readers have no write path) and refuses to collect otherwise. It only makes outbound, signed requests.
04 · We do not say

Not yet.

What we refuse to claim until it is real — with the exact unlock condition for each. When one unlocks, it moves up and the changelog records the date.

Any large-dataset research stat (e.g. “10,000 repos”, “54,767 workflows”, “80.7 %”), or any third-party repository named as a data sourceUnlockA published dataset with methodology, a signed manifest, blob OIDs, and an opt-out.
“Z3-proven”, “solver-proven”, “formally proven” delegation; “the only implementation whose attenuation is formally proven”UnlockThe solver invoked on the delegation path with a native timeout and a real-solver timeout test, and the SMT-LIB embedded in receipts.
“Mathematically proves” access was narrowed (unqualified)UnlockLayer-7 blocking enabled per environment with the veto documented — until then use the checked wording above.
npx @trustfix/receipt-verifier as a one-line install, a “hosted air-gapped verifier”, a “checksummed mirror”UnlockThe package published, the binary runs on a clean machine, the HTML hosted, the key mirror + SHASUMS live, the key directory signed, and genesis pinned.
“Verified against real tenants” / “tested live” for any connector beyond AWS and GitHubUnlockA dated, committed real-tenant record for that connector.
“Continuous” / “near-real-time” / “monitored” / “confirmed closed after merge”UnlockThe scheduler + tick secret in both deploys, with ticks observed in the logs.
Any pricing tier — “Pro”, “$499”, “$799”, “free tier”, “free trial”, “start free”, “/signup”, “no credit card”UnlockNever. TrustFix is enterprise, request access. Free = the OSS CLI and the Readiness Check only.
A vendor model name (Claude, Sonnet, GPT-4o, Gemini) on any customer surfaceUnlockNever on a customer surface — we say “TrustFix AI” / “a second model”.
“Patent pending”, “patented”, “USPTO-disclosed patent component”UnlockPatent application numbers in hand → “patent pending (US provisional)”.
Retired numbers — “6-layer”, “450 pre-validated templates”, “45+ assertions”, “94/100”, “Below 50 = blocked”UnlockRetired. Use the computed set above; label any illustrative UI block “example”.
“Auto-remediates” / “AI-generated Terraform PRs”UnlockSay “opens reviewed, template-first Terraform PRs; proven for the OIDC/IAM trust family”.
“SOC 2 in progress” as a certification claim, “pentest scoped and scheduled” as an attestationUnlockAn engagement letter exists (we may state the honest interim status, never a certification we do not hold).
Fabricated testimonials, customer logos, or install counts; “every fix proven”; “no false positives”; “detects everything”UnlockNever.
“No competitor generates fix PRs”, “the only platform that opens fix PRs”, “competitors only detect / ship dashboards”UnlockNever: refuted (other vendors open fix PRs). Say the fix-proof line above: a signed receipt and a certified diff that verify offline.
“The first” / “the only” agent gate or MCP gatewayUnlockNever: refuted. Say the agent-gate line above: decisions sealed to the ledger, delegation checked to only narrow.
“Unique” / “only” on-prem NHI coverageUnlockNever: refuted. Say the on-prem line above: a read-only sensor with no command channel that proves itself before it collects.
“Every TrustFix component on a customer estate — sensor, policy enforcement point, agent passport holder — enrolls with a one-time code minted by the customer and receives its own sealed credential once. No credential is ever typed, copied, shown to an operator, or sent by email.”UnlockBuilt and tested locally end to end; it unlocks when kit 1.2.0 is published and a new organization’s estate has enrolled every component this way through the staging deployment, with the record committed.
05 · Changelog

What changed, when.

A new entry whenever a “Not yet” unlocks or a build-time number changes.

  • 2026-09-12Claims Card v3 issued; numbers computed at commit d63fe404. Detector counts read from the live registry, never a literal.
  • 2026-09-13Delegation solver wording reconciled to the machine-checked reachability (the Z3 solver is reached 0 times on the shipped delegation corpus — a deterministic subsumption check produces the verdict). Status list moved to RFC 1950 (zlib) framing.
  • 2026-09-13UNLOCKED “W3C Bitstring Status List”: a real, signed W3C BitstringStatusListCredential is now served for the Agent Passport credentialStatus (GZIP + multibase encodedList), alongside the IETF Token Status List for JWT consumers — both pass third-party verification (@noble + plain zlib, no TrustFix code). Certifier fix-path SMT check machine-checked as genuinely reached (positive solver count), unlike the delegation path (zero).
  • 2026-10-08Three competitive claims retired after the October competitive research refuted them: fix-PR exclusivity, a first/only agent or MCP gate, and unique on-prem coverage. Replaced by what can be verified: the fix-proof, agent-gate and on-prem sensor lines.
  • 2026-10-10Per-component enrollment added as BUILT (not yet claimable): every on-prem component enrolls with a customer-minted one-time code and its own sealed credential. It unlocks after the staging run with a new organization.

Audited at commit d63fe404. Numbers re-derive on every release; this page imports the counts from the registry, never a literal. See the Trust Center for the security whitepaper, questionnaire, and pen-test methodology.

Claims | TrustFix