Trust center

Measured by applying every repository migration to an empty PostgreSQL database. This is not presented as a current production census; the published command can be run read-only against production for a fresh comparison.

psql "$DATABASE_URL" -Atc "select count(*) filter (where c.relrowsecurity) || ' shielded of ' || count(*) || ' tables' from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = 'public' and c.relkind = 'r'"

The fact that makes the shield real rather than decorative. It became true on 17 August 2026, and this page says what it was before.

psql "$DATABASE_URL" -Atc "select current_user, rolsuper, rolbypassrls from pg_roles where rolname = current_user"

Run on a disposable database built from every migration. The check fails if a table is neither shielded nor explicitly classified, if an unshielded table is granted to a web role, or if an inventory entry outlives its table.

CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify

The verifier is read-only by construction and may be pointed at production.

CONTROLFRAME_VERIFY_DATABASE_URL="$DATABASE_URL" npm run security:super-admin:verify

Ed25519 over canonical JSON. The signed body identifies each measurement target, keeping migration-chain results separate from production observations, and is verifiable without a ControlFrame server in the trust path.

Two findings are published with containment and remediation details, including a tenant-isolation defect corrected on the date reported.

audit_access_logs carries prev_sha256 and row_sha256 per row, so a removed or edited entry breaks the chain.

inferenceBoundary, costBoundary and rawDataPolicy travel on every route and every run trace. The residency page renders them from the router at request time rather than describing them.

Credentials and signing private keys remain runner-side. Legacy collection may submit bounded raw artifact bytes for custody, scanning, redaction, and review. Runner v2 is verify-only and grants no target, credential, artifact, evidence, or execution authority.

The gate is fail-closed per deployment; a blocked call raises a typed error so the block itself is sealed as an auditable event.

The disposable-database verifier proves anon and authenticated grants are revoked, including default privileges for future tables, and fails if an unshielded table is granted to either. This is a migration-chain result, not a production grant census.

CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify

Derived from the dependency manifest, the host configuration, and the modules that open outbound connections — each row names the file it was derived from.

Scope, safe-reporting guidance, triage, and out-of-scope categories are published.

No independent SOC 2 report is available or claimed. Readiness work does not constitute an examination or attestation.

Business Associate Agreement readiness is under legal and security review. HIPAA has no product certification to hold, and ControlFrame does not claim platform-wide HIPAA compliance.

Not held, not in progress, and not claimed anywhere on this site.

Internal adversarial testing covered privileged access and evidence-sharing surfaces on 17 August 2026. No independent penetration-test report or summary letter is available.

Both remain templates pending counsel review. The effective privacy notice describes the implemented public lead-data path.

No pre-filled questionnaire is currently available. Buyers may provide their standard questionnaire for a scoped response.

The platform runs in AWS us-east-2 today. EU residency is a build, not a configuration setting, and no date is committed here yet.

Not available. ControlFrame will not claim customer-managed encryption keys until a customer-held key wraps the credential root and the boundary can be verified.

A deployment can be pointed at a customer-controlled model endpoint today. Per-organization keys are not shipped, and the platform-key fallback is a deployment setting rather than a tenant one.

A release-bound Runner v2 verify-only package and root-owned installation contract are available for signed binding verification. They grant no browser, target, credential, artifact, evidence, or CMS execution authority. The separate execution-capable appliance and custody contract are not released.

No customer-dedicated application stack is currently offered. The shared topology relies on forced row-level security, a dated non-bypass production runtime-role observation, migration-chain closed-world verification, and production-safe adversarial probes.