Current assurance truth
No external certification is implied.
Internal SBOM, tests, source provenance, secret scanning, tenant controls, and release evidence support diligence. SOC 2, ISO 27001, regulatory approval, and external penetration testing remain unclaimed unless independently completed.
Data boundary
No broker secrets in diligence exports.
Share Evaluation and Local Scanner contracts reject sensitive field names, omit content values by default, require explicit redaction before upload, and bind access to workspace, viewer, permission, expiry, and revocation.