Trust Center

Everything your security team asks for, in one place.

The whitepaper, a self-serve security questionnaire, our pen-test methodology, service-level commitments, live status, and every legal document — with honest status on every certification, never a claim we can't back.

01 · Trust resources

Start here.

Security whitepaper
A code-grounded description of our architecture and security model — every control enforced by code, every gap stated plainly.
Open
Security questionnaire
Self-serve CAIQ / SIG-Lite, pre-answered from our real controls. Each answer links to the code-backed proof.
Open
Penetration-test methodology
Our test scope, the continuous automated isolation suite that runs on every build, and honest third-party pen-test status.
Open
Service-level commitments
The commitments we actually make — response targets and product guarantees. No fabricated uptime figure.
Open
System status
Live health of our public endpoints and an incident history. Per-connection status lives on your authenticated status page.
Open
Trust Center
Our security posture, the open standards we implement, agentless read-only data handling, and responsible disclosure.
Open
02 · Certification status

Honest about where we are.

We will say a framework is certified only once an independent auditor has signed off — and we will link the report here when that happens. Until then, this is exactly where we stand.

SOC 2
In progress — no certificate held
ISO 27001
Control mappings — not certified
Third-party pen test
Scoped & scheduled — no attestation yet
Independent trusted timestamping
Not used — signatures are Ed25519 + Merkle

Separately, the product helps your team produce auditor-ready evidence mapped across seven frameworks — exported as NIST OSCAL and verifiable offline. That is a TrustFix feature for your compliance program; it is not a claim about TrustFix’s own certification status. Read the boundary in the whitepaper’s §8.

03 · Legal & trust documents
Privacy PolicyTerms of ServiceData Processing AddendumSub-processorsAcceptable UseCookie Policy

Operated by Vikavi Security LLC, a Delaware LLC · Greater St. Louis, USA · security@trustfix.dev

Trust Center | TrustFix