What a conformance record cannot establish
A conformance record can prove that it has not been altered. It cannot prove that the party who produced it was independent of the thing being tested. This page states the difference, because every assurance claim turns on it.
Five things a record cannot say about itself
- Integrity is not independence. A digest proves the bytes are intact. It says nothing about who produced them, or whether that party could have produced a different result. A record that grades its own independence has graded nothing.
- Persistence is not verification. An external timestamp or a transparency log establishes that a record existed at a time and was not backdated afterwards. Neither of them checks the requirement, and neither becomes a party who could. A timestamp is worth having. It is durability, not independence.
- A co-signature is not a peer witness. Two parties signing the same bytes is non-repudiation. It becomes a peer observation only when the second party did work of its own: it drove its own client against that deployment, or it holds the wire transcript and the test vector. Without that artifact the two are identical in a ledger row, which is why a label written by the producer cannot settle it.
- A description is not a derivation. If a scope is justified in prose, a reader cannot compute it. It is still asserted, only one step further from the field name. The only scope worth trusting falls out of comparable identifiers, so that two parties reach the same answer from the same data.
- An exclusion is not a result. A case that cannot be scored is evidence about the specification, not a silent omission. It should be named, dated and excluded on the record, with the gap that caused it stated in words.
What an independent check looks like
One lift survives all five tests. A party that is not the producer, holding its own client and its own copy of the vector, drives the deployment and keeps the transcript. It then issues a statement, signed with its own key, that names the requirement it checked and the artifact it checked it against.
That statement is checkable by anyone. It does not ask a reader to trust the producer. It does not ask a reader to trust us either.
How we produce it
Independent conformance verification
from $7,500
We drive our own client against your deployment, keep the wire transcript and the vector, and issue a signed statement for each requirement we checked. The statement is yours to publish, and any reader can verify it without us.
Per deployment, per profile.
Deployment attestation preflight
from $3,500
A check of the conditions a conformance claim depends on: signing enabled with development mode off, encrypted transport off loopback, secret file permissions and rotation posture, a durable audit sink with fail-open alerts, and approved versions against recorded configuration.
One-off, with the evidence behind each check.
Conformance custody
from $2,500 / month
We re-verify your conformance records on a schedule and hold the verification artifacts, so the claim that they were checked at a point in time is held by somebody other than the party making it.
Monthly signed report, cancellable.
What none of this is: we do not certify you. A signed statement is not a legal opinion. We tell you which requirement we checked, what we observed and what the observation does not cover. If we cannot reach a requirement, the statement says so. The full list is on the price page.
Ask for the check, not the certificate
If a customer is asking you to prove a conformance claim, the useful question is who checked it and with what. We will tell you before you pay.