Trust, access, and disclosure. One document.

The engagement itself runs on our systems; what we hand back, the evidence corpus (requirements, findings, and tests, in plain YAML and code) and the audit gate that re-runs them, runs in your CI without us.

Whichever model applies, the scope is the same: indexing covers the repository and its history, and, only with your approval, read access to the systems where intent lives, typically the issue tracker and the support queue. The audit reads; it does not write.

Access is minimal by construction: source code is all the audit needs. We do not ask for secrets, credentials, or production access; the rare exception is whatever the component itself requires to run, a license key for a build, named at scoping. Engagement data is encrypted in transit and at rest, and access to it is limited to the people named on the engagement.

Three subprocessors handle engagement code and model work: Anthropic, OpenAI, and xAI. Client code reaches them only through their commercial APIs, under terms that exclude training on customer data, and each maintains a SOC 2 program with attestations available through its trust portal — the three names above link to those portals. If your policy excludes a given provider, say so at scoping: the engagement runs only on the providers you allow. And we will walk your AppSec team through each provider’s current retention posture at scoping, in writing. There are no other subprocessors in engagement work on your code: no offshore review, no data brokers.

Separately, on analytics: this website and the hosted cloud portal both run PostHog (EU cloud) for product and usage analytics — for you as a visitor that means we can see which pages and views get opened and used, on EU servers, and nothing about your code. In the portal, client data is redacted from what it collects. For teams whose policies do not allow that, a self-hosted installation is available: the portal runs on your own infrastructure. The portal is optional either way, and engagements that skip it get the same views as generated static reports instead. If this list ever changes, this page changes first, and standing clients hear it from us before they read it here.

Yours is fine. We countersign your NDA, same day, and read no private code before it is in force. A signed data-processing agreement is available at scoping.

The boundary: the evidence corpus is yours, in your repo; the engine that produced it is ours.

Said without the policy voice: a client’s requirements corpus describes their product in enough detail that publishing it would publish the product, and no permission fixes that. We hold our own corpus to the same rule — the engine’s full requirements tree describes the engine, so it stays private too.

We do not currently hold a SOC 2 report, and we do not present ourselves as a SOC 2–certified vendor.

For private engagements, your code is handled under NDA as described in section 02 (access models and subprocessors). The evidence corpus and audit gate we deliver live in your repository and run in your CI; the hosted portal is optional and not required for the engagement to work.

We complete security questionnaires as part of scoping. If your procurement process requires a current SOC 2 report before work can start, we will tell you plainly on the first call that we cannot clear that bar yet, rather than stretch what we have.

Proof is operated by Replay Technologies LTD, registered in Armenia at 36 Manushyan, Yerevan 0012. Engagement contracts name this entity. And your paper is fine here too: we typically contract on your template, under your governing law, so your counsel reviews terms they already know.

Findings derive their authority from runnable reproducers — and a named signer can only stand behind so much work, so we take a limited number of engagements each quarter. Proof is a young practice; the deliverable is designed so that limited concurrent capacity does not put what you rely on at risk.

The entire corpus lives in your repo as plain YAML and executable tests. The audit gate runs without us, in your CI, on every release. Nothing you depend on day to day is hosted by us or gated on our availability. The gate runs offline if your environment demands it: release artifacts are checksummed and can be mirrored into internal distribution, and tagged releases are immutable.

And if you stop: you keep everything that runs. The gate keeps checking yesterday’s promises; nobody keeps writing tomorrow’s.

Security-relevant findings follow coordinated disclosure, case by case, worked out with the affected maintainers or vendor.

When you need a certified penetration test, for SOC 2, PCI, or a customer security review, engage an accredited security firm; our audit does not substitute for that report, and we say so at scoping. The same holds for black-box red-teaming, infrastructure testing, and social engineering. Security promises inside the audited component’s scope are ours to prove; those artifacts are theirs.

The public register shows the policy in practice: where we have not asked for approval, entries appear anonymized, and say so on their face — one live entry reads that the client is not named because we had not asked permission when it shipped, and that it will be updated if permission is granted.

Two kinds of machine involvement: deterministic checks, which pass or fail; and AI drafting assistance, whose output must survive those checks. Machines check everything, every time; a person validates every finding before it reaches you. Which systems see your code is governed by the access model in section 02 and the subprocessor list above. The fuller disclosure lives on the methodology page.

Work email, required: so we can reply. Everything else on the demo form is optional and only shapes the first reply — your name, your company, the component you would start with, the timing, and whether your code is public or private. You can leave all of it blank.

Every request gets a reply. Scoping is confidential, and private early access is deliberately small: we take on a limited number of engagements at a time.