Getting started

Platform quick start

Zero to your first signed fix: connect your estate, discover, find your highest-consequence risk, let the engine verify a fix, and get a signed receipt.

This guide walks you from a fresh account to a cryptographically signed first fix. Every screen described here is wired to your own organization's live data — TrustFix never fabricates progress, findings, or verdicts. The guided version lives in-product at Get Started (/get-started), and each of its five stages is gated on real org state returned by GET /api/onboarding/journey.

TrustFix uses first-party authentication (TFID). There is no self-serve signup — accounts and organizations are administrator-provisioned. Your first login is two steps: set a password from your /setup invitation link, then enroll mandatory two-factor (TOTP). After that, day-to-day sign-in at /sign-in is email + password followed by a 6-digit code.

1. Connect once

One read-only, agentless grant at the org root fans out across every account, project, and repo beneath it. There is nothing to install in your workloads, and TrustFix never writes to your estate. Start from the connector catalog at Onboarding (/onboarding) — see connect your estate for the per-provider grants.

2. Discover what you run

The first scan walks your estate — no agents, no sampling — and fills your inventory: open findings, criticals, highs, and the time of the last scan. The scan kicks off automatically after you connect a provider. Your discovered identities surface on The Index.

3. Find your highest-consequence finding

The journey surfaces the single most consequential open finding — its severity, risk score, affected resource, and impact summary — so you start where it matters instead of at the top of an alphabetical list.

4. Let the engine verify a fix

Click Run the engine on this finding. This calls POST /api/remediation/preview with dryRun: true: a true preview. The full Policy Intelligence Engine runs — ending in a formal proof that the new policy only narrows access — but no pull request is opened, no credit is spent, and nothing is written to your estate or ledger.

The verdict is whatever the engine actually returns:

Verified by the engine — a per-layer score, the first lines of generated Terraform, and a real blast-radius summary.
Engine refused to ship — an honest refusal listing the failed assertions. The verified stamp is never applied to a fix the engine couldn't prove safe; the rejected draft is held for manual review rather than shipped.

When you're ready, Apply re-runs the pipeline, consumes a credit, opens a real fix PR, and writes a signed receipt. If the engine refuses at apply time, no PR is opened and no receipt is written.

5. The signed receipt

Every shipped, verified fix is written as an Ed25519-signed entry in your hash-chained Trust Ledger. The journey shows the latest entry — sequence number, entry and previous hash, signature preview, signing key id, timestamp — and a live chain check. The signed receipt is minted only on ship; the dry-run preview in step 4 never creates one.

From here, browse the full ledger at Trust Ledger (/trust-ledger), verify any entry's Merkle inclusion proof, and explore the rest of the platform screens.