TrustFix

Concepts

Evidence & compliance

Audit-grade evidence generated, not gathered — real signed artifacts mapped onto the controls auditors ask for, with empty controls shown honestly.

TrustFix produces audit-grade evidence, generated not gathered. Instead of asking you to screenshot a config the night before an audit, it maps the artifacts it already signs — ledger receipts, agent passports and revocations, MCP and delegation attestations, merged remediation PRs, scans, and NHI inventory — onto the controls auditors ask for. One signed artifact often satisfies several controls at once.

Frameworks it maps to

The evidence pack maps real, signed artifacts onto controls across security and AI-governance frameworks:

  • SOC 2 — Trust Services Criteria, particularly change-management evidence (CC6 / CC8).
  • ISO/IEC 27001 — information-security management controls.
  • NIST 800-53 — federal control catalog.
  • OWASP ASI — the Agentic Security Initiative top risks (for example, the MCP tool-drift pin maps to ASI01, and action attribution to ASI03).
  • ISO/IEC 42001 — AI management systems.
  • NIST AI RMF — the AI Risk Management Framework.
  • EU AI Act — Annex IV technical documentation, supported by a signed AI-BOM.

We describe the frameworks rather than promise a fixed control count: coverage depends on what artifacts your estate has actually produced.

Honest by construction

A control with no backing artifact is shown as EMPTY, never fabricated, and in the signed OSCAL export those EMPTY controls become open POA&M items. Every evidence item carries a real Trust Ledger entry id and verifies via a Merkle inclusion proof, so an assessor can confirm each one independently.

Honest boundary on timestamping

Evidence is Ed25519-signed and Merkle-anchored, but not yet independently third-party-timestamped — the export states this plainly rather than imply qualified timestamping. The OSCAL pack is positioned as evidence, not a certification or conformity assessment.

Where you see it

The Evidence screen (/evidence) shows the control-coverage matrix and the detailed evidence, reading GET /api/evidence and GET /api/evidence/matrix. Export a signed NIST OSCAL Assessment Results document, JSON, or CSV via GET /api/evidence/export?format=oscal|json|csv.

← Trust Ledger & proofsPosture screens →