Signed posture receipt

Dated measurements against explicitly named targets, sealed and verifiable without a ControlFrame server in the trust path. Migration-chain results and production observations remain distinct inside the signed document.

How each number is produced Back to the trust center

Sealed

This posture is signed

The document below is signed with Ed25519 over canonical JSON, in the same governed-receipt/v1 envelope ControlFrame evidence exports carry. The public key travels inside the receipt, so verification needs no network call to us.

Signing key fingerprint

SHA-256 of the raw 32-byte Ed25519 public key. Pin this once; it does not move between deploys, and a rotation leaves every previously issued receipt verifiable because the public key travels inside each one.

Detached signature (base64)

Over the UTF-8 bytes of the canonical signed body. Ed25519 is deterministic, so the same document and key reproduce these exact bytes — this value and the one the endpoint returns are the same value, or something is wrong.

Verify this receipt at the neutral public verifier — the link carries the receipt itself, so the verification runs in your browser against the embedded public key.

Document digest (SHA-256 of the canonical document)

Computed with no key involved, so it is reproducible by anyone holding the document — signed or not. Sorted keys at every level, no insignificant whitespace, UTF-8 bytes.

Fetch the receipt yourself

curl -s https://controlframe.ai/trust/posture/receipt.json | jq .

The endpoint returns the same document this page renders, sealed the same way. It is the shortest path from reading a trust page to checking one.

What is sealed

The measured posture

Every figure below carries the date, target, and command that established it. The schema census comes from all migrations applied to an empty PostgreSQL database; runtime-role, break-glass, and cross-tenant observations name production as their separate target. None is presented as a target it was not measured against.

tables in the public schema

carry forced row-level security

unshielded because a predicate cannot apply

unshielded with no good reason

neither shielded nor ledgered

unshielded tables reachable from a web role

Measured 2026-08-24 against all repository migrations applied to an empty PostgreSQL database. The command seeds probe tenants and creates a role, so it runs against a disposable database with migrations applied — it refuses a remote one unless explicitly overridden.

Sealed measurements, their dates, and their commands
Field	Value	Measured	Target	Reproduced by
public_schema_tables	81	2026-08-24	all repository migrations applied to an empty PostgreSQL database	psql "$DATABASE_URL" -Atc "select count() filter (where c.relrowsecurity) \|\| ' shielded of ' \|\| count() \|\| ' tables' from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = 'public' and c.relkind = 'r'"
tables_with_forced_row_level_security	53	2026-08-24	all repository migrations applied to an empty PostgreSQL database	psql "$DATABASE_URL" -Atc "select count() filter (where c.relrowsecurity) \|\| ' shielded of ' \|\| count() \|\| ' tables' from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = 'public' and c.relkind = 'r'"
tables_unshielded_and_ledgered	18	2026-08-24	all repository migrations applied to an empty PostgreSQL database	CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify
tables_pending_tenancy	10	2026-08-24	all repository migrations applied to an empty PostgreSQL database	CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify
tables_unaccounted_for	0	2026-08-24	all repository migrations applied to an empty PostgreSQL database	CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify
unshielded_tables_reachable_from_web_role	0	2026-08-24	all repository migrations applied to an empty PostgreSQL database	CONTROLFRAME_TEST_DATABASE_URL="$DISPOSABLE_DATABASE_URL" npm run security:tenant-shield:verify
runtime_database_role	controlframe_app	2026-08-17	the production database	psql "$DATABASE_URL" -Atc "select current_user, rolsuper, rolbypassrls from pg_roles where rolname = current_user"
can_bypass_row_level_security	false	2026-08-17	the production database	psql "$DATABASE_URL" -Atc "select current_user, rolsuper, rolbypassrls from pg_roles where rolname = current_user"
break_glass_role_holders	0	2026-08-17	the production database	CONTROLFRAME_VERIFY_DATABASE_URL="$DATABASE_URL" npm run security:super-admin:verify

Cross-tenant read probe sealed into the receipt
Organization context set	Audit runs visible	Evidence objects visible
The organization the project belongs to	1	10
A foreign organization, same project identifier	0	0
A second foreign organization, same project identifier	0	0

Measured 2026-08-18 against the production database. The command only reads and may be pointed at production.

Also sealed

The claims this receipt states are not true

A signed statement of what is not claimed is the half a diligence team cannot get anywhere else. A false certification claim discovered in diligence ends the deal, so the absence belongs inside the artifact the buyer verifies rather than in a footnote underneath it.

soc-2-certified
hipaa-certified
iso-27001-certified
eu-data-residency
customer-managed-encryption-keys
per-organization-byok-inference
single-tenant-application-deployment
execution-capable-enterprise-runner-appliance
third-party-penetration-test

Read this list as written: each entry is a claim ControlFrame does not make. The trust center carries the same list in plain language, with the reason and the date beside each.

Provenance

What this receipt does and does not attest

The seal proves that this exact document was produced by the holder of this key. It does not, by itself, prove the measurement was taken honestly — that is what the commands are for, and why every one of them is printed on this site rather than described.

Deploy commit unavailable: This environment does not expose the built commit, so the document records the absence rather than omitting the field. A missing key would change the canonical bytes and make two honest renderings look different.
No render timestamp: The document carries measured-at dates and no wall-clock time. That is what makes the signature reproducible: refreshing this page does not mint a new artifact, and two people comparing receipts compare the same bytes.
Verification path: Canonical JSON with sorted keys, an Ed25519 detached signature over the signed body, a second SHA-256 digest of the body the verifier re-derives independently, and the public key embedded in the receipt. No ControlFrame server participates in checking it.
Scope: Migration-chain tenant-isolation inventory plus separately dated production runtime-role, break-glass, and cross-tenant observations. It is not a certification, not an audit report, and not a statement about controls outside the database boundary.

The artifact

The receipt, in full

Show the signed receipt JSON

{
  "format": "governed-receipt/v1",
  "algorithm": "Ed25519",
  "body": {
    "profile": "controlframe.trust-posture.v2",
    "subject": "ControlFrame tenant-isolation posture",
    "measurement_scope": "mixed-target; each section declares its target",
    "measured_at": "2026-08-24",
    "source_commit": "unavailable",
    "database_tenant_isolation": {
      "measured_at": "2026-08-24",
      "target": "migration-chain",
      "public_schema_tables": 81,
      "tables_with_forced_row_level_security": 53,
      "tables_unshielded_and_ledgered": 18,
      "tables_pending_tenancy": 10,
      "tables_unaccounted_for": 0,
      "unshielded_tables_reachable_from_web_role": 0,
      "policy_name": "controlframe_tenant_shield",
      "census_command": "psql \"$DATABASE_URL\" -Atc \"select count(*) filter (where c.relrowsecurity) || ' shielded of ' || count(*) || ' tables' from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = 'public' and c.relkind = 'r'\"",
      "closed_world_command": "CONTROLFRAME_TEST_DATABASE_URL=\"$DISPOSABLE_DATABASE_URL\" npm run security:tenant-shield:verify"
    },
    "runtime_database_role": {
      "measured_at": "2026-08-17",
      "target": "production-database",
      "role": "controlframe_app",
      "is_superuser": "false",
      "can_bypass_row_level_security": "false",
      "command": "psql \"$DATABASE_URL\" -Atc \"select current_user, rolsuper, rolbypassrls from pg_roles where rolname = current_user\""
    },
    "break_glass_role": {
      "measured_at": "2026-08-17",
      "target": "production-database",
      "role": "super-admin",
      "holders": 0,
      "command": "CONTROLFRAME_VERIFY_DATABASE_URL=\"$DATABASE_URL\" npm run security:super-admin:verify"
    },
    "cross_tenant_read_probe": {
      "measured_at": "2026-08-18",
      "target": "production-database",
      "contexts": [
        {
          "context": "The organization the project belongs to",
          "audit_runs_visible": 1,
          "evidence_objects_visible": 10
        },
        {
          "context": "A foreign organization, same project identifier",
          "audit_runs_visible": 0,
          "evidence_objects_visible": 0
        },
        {
          "context": "A second foreign organization, same project identifier",
          "audit_runs_visible": 0,
          "evidence_objects_visible": 0
        }
      ]
    },
    "claims_not_made": [
      "soc-2-certified",
      "hipaa-certified",
      "iso-27001-certified",
      "eu-data-residency",
      "customer-managed-encryption-keys",
      "per-organization-byok-inference",
      "single-tenant-application-deployment",
      "execution-capable-enterprise-runner-appliance",
      "third-party-penetration-test"
    ],
    "body_sha256": "254e328ccaee3de1024e2d467a5d6766d86942f63dbb57066fcafdb82764b697"
  },
  "signature": "x+rFGL5BHDj5g4yoZGGSrDP79pnPXvIaDGgFmHBmty0Nl4cynlKGb4kmZXrdEcn/I6ZWOyabS0EpYROJ3gwdDA==",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAs4Noy7J72ylvUMC7nwf20na5aBUzbVX8aDs9/Uxpcdw=\n-----END PUBLIC KEY-----\n"
}

See how each of these numbers is produced · Back to the trust center