Most of this page is about how little we need. A standard screen runs against the model as your vendor ships it, so the honest answer to “what data do you take” is: the name of the model. Everything below states what happens when an engagement needs more than that.
Your name, your organisation, an email, the receipt number, and the model to test — plus the provider or endpoint if it is not obvious. That is the entire intake. We run the battery against the published model the way your vendor ships it. No system prompt, no documents, no credentials, and no access to anything you operate.
Testing your deployment rather than the bare model means we need the system prompt and the tool definitions, because those are the thing under test. We do not need your production data, your customer records, or a key to any live system — every tool in the battery is mocked. Nothing in any run sends a real message, touches a real record, or moves a real dollar.
Every prompt and response from an engagement is encrypted into the evidence pack, and the key is generated per run and delivered beside it. That is a deliberate change: a single long-lived key once encrypted every client’s transcripts, which meant one key opened all of them. It was retired. Your pack opens with your key and no other.
Findings ship as a sealed evidence pack: the exact inputs, the exact outputs, the grading, a fixed seed, and a manifest recording the instrument version and the commit it ran at. There is no portal to keep paying for and no account to lose access to. If we vanished tomorrow, the pack still opens and still verifies.
We do not name clients, publish client findings, or use an engagement as a case study without written permission. Everything on our public record — the disclosures, the four-model study, the specimen report — is our own research on publicly available models, run at our own cost. An NDA can be executed before scoping if you would rather it were signed than stated.
We hold none of those certifications today. If your procurement process requires a certified supplier, we will not clear it, and it is better that you learn that here than three weeks into a review. What we offer instead is the thing certification is a proxy for: a published method, a sealed and reproducible artifact, and findings you can check yourself rather than take on trust. We do not issue certificates — we produce the evidence they rest on.
The auditor will not start on an uncommitted working tree or an untagged build, because a pack has to name the exact code that produced it. If too much of a run fails to execute, it aborts rather than publish a partial campaign as an audit — a model that did not execute is untested, not safe. Errored runs are excluded from rates rather than counted as passes. These guards exist because each of them once caught us.
If your security review needs something this page does not answer, ask and we will answer it in writing. A question we cannot answer straight is worth knowing about before money changes hands, not after.