← proofpane.com

Trust Center

Plain text, structured, written for security review — no marketing images. Each item is tagged shipped or roadmap so you always know which is which.

Last updated: 2026-08-10 · Security contact: [email protected] · Company stage: early (no customer deployment yet; platform collaboration and the direct governance offer run in parallel — neither waits for the other) · Founder: Louie Lu on LinkedIn

Legal entity registered

Deployment models shipped

Two models, and we are precise about which one has been run. Enforcement is local in both: the daemon runs on the user's machine, and DLP redaction happens before a model ever sees the text. What differs is where the control plane and the audit chain live.

Data flow — what leaves your machine shipped

What our logs contain — and do not contain shipped

Audit-log integrity shipped

Encryption & key custody shipped

Tenant isolation shipped

Retention & backups shipped

Subprocessors (current)

Upstream work on an independent standard — the founder's own

Louie Lu's pull requests are merged into trace-spec (TRACE, an open attestation standard for agentic AI governance) and its conformance-test repository — neither owned, maintained nor funded by Proofpane. What was merged: conformance vectors for receipt rules that had none, profile-cutover enforcement at verification time, RFC 8785 portable vectors, and a schema resync that fails on the next drift. Those gaps were found by applying the load-bearing-coverage criterion — from the founder's third paper, a mechanical test of whether a conformance suite can be passed without doing the work — to that standard, whose receipts are its first corpus — the method run against someone else's artifact, the fixes accepted by their maintainer.

This is the founder's personal contribution, not the company's. Counts are deliberately not quoted because they move on the maintainer's schedule — the current state of every pull request is one query. A merged pull request accepts specific fixes; it is not an endorsement of Proofpane or a certification of it, and the criterion has still not been applied to Proofpane's own conformance suite.

Community directory listings — recognition, not security testing

Three independent, community-curated directories; none ours, none paid. Every listing states plainly that Proofpane is a closed-source proprietary daemon and links the CC BY 4.0 reference architecture.

Assurance status, at a glance

Code signing in one line: macOS signed and Apple-notarised, Windows unsigned, Linux SHA-256 digests. Three separate rows — a summary that reports "Proofpane binaries are unsigned" has carried the Windows row over to macOS, where it does not hold.

External verdicts, intelligence and recognition

These are different currencies, so they stay separated: Apple controlled its own verdict; external communities maintain the advisory data and rules that our scanners consume; maintainers controlled whether to merge the directory listings. Only the first is an external check run against a named Proofpane artifact. None is an independent security assessment.

And the honest limit on all of it: we run these, and we configure them. We choose which rulesets, we set the baseline, and we wrote the allowlist that suppresses twelve secret-scan findings as false positives — each with its reason recorded, and every one of them checked, but checked by us. An external tool operated by the party being examined is not an external assessment, and describing it as one would be exactly the move this page exists to avoid.

What that leaves genuinely open, and what money and a customer engagement buy: nobody has been paid or invited to attack this product. No penetration test, no bug bounty, no red team, no security review by a named assessor. Researchers are welcome at the security contact above, and a finding will be published here whatever it says.

Daemon security model

The obvious objection first, in our own words: the daemon is a high-privilege security chokepoint — it proxies MCP tool calls and can touch the filesystem and shell on the machines it governs. We treat it that way by design:

What design cannot substitute for: a third-party penetration test (roadmap below). We consider that the single most legitimate objection to installing Proofpane today, and it is scheduled against the first enterprise engagement rather than denied.

Certifications & assurance roadmap

What we test, and what testing establishes shipped

A pen test and a test suite answer different questions. An assessor asks what can an adversary do that you did not think of. A suite asks does the thing you built still do what you said. Only the first needs somebody who does not share our blind spots, which is why it is on the roadmap above and nothing here replaces it. The second is ours to do properly, and this is what it currently covers.

5,650 backend tests across 464 files, plus 29 frontend suites and a Playwright end-to-end spec. Rather than a total, the useful breakdown is by the property under test:

17 structural guards. These are the unusual ones, and they exist because a fixed bug that can silently return is not fixed. Each forbids a class of defect rather than an instance, and each was written after that class actually bit us:

Automated scanning runs on pull requests and weekly: SAST (Semgrep, Bandit), dependency auditing (pip-audit, npm audit, cargo audit), and secret scanning over full git history (gitleaks). Findings are held against a committed baseline that may shrink and not grow, so a new one is visible without pretending the backlog is zero. First run, 2026-08-07: five high-severity findings triaged to zero, and twelve secret-scan hits — all twelve false positives, individually checked, allowlisted with reasons rather than left to make the number meaningless.

Whether a suite tests what it names is a separate question from how many tests it has, and counting does not answer it. A rule that is named by a test but never decides that test's outcome can be deleted from an implementation, which will still pass. We published the method for measuring this rather than only asserting we had thought about it: Load-Bearing Coverage — Mechanically Checking Whether a Conformance Suite Can Be Passed Without Doing the Work (2026-08-08, CC BY 4.0; implementation Apache-2.0). A rule counts as load-bearing only if deleting it from the reference verifier changes at least one published vector's outcome. Across nine measurements on seven corpora in three languages, suites that pass in the sense their authors intend were found certifying implementations that could skip obligations entirely — and the paper reports the same method turned back on its own suite, including three findings that were bugs in the checker.

What none of this establishes. Every test here encodes something we already thought of. That is precisely the limitation an independent assessor exists to address, and no amount of self-testing closes it — a suite cannot surprise its author.

And the criterion above has not been run against the suite on this page. It was built for conformance vector sets with a reference verifier to mutate, which is not the shape of most of these tests; adapting it is work we have not done. So the honest position is that we can state the standard and have applied it elsewhere, while the 5,650 figure remains a count — and this paragraph is here because publishing a method for detecting overstated coverage, and then quietly exempting yourself from it, is the failure the paper is about.

Specific gaps we would rather name than have found: no third-party penetration test; no adversarial review of the tier classifier by someone trying to defeat it; the hardware authorization path (R3-dev) cannot run in CI at all and is verified by measurement on a physical device; and the self-hosted deployment model has never been exercised inside a customer environment.

Incident response

Legal boundary. Proofpane produces operational evidence — a tamper-evident, independently verifiable record of what your AI systems actually did. It does not replace legal advice, certification bodies, or a regulator's judgment, and using Proofpane does not by itself make an organisation compliant with any framework. Control mappings (NIST AI RMF, ISO/IEC 42001, EU AI Act, GDPR, SOC 2) indicate which controls an exported record can evidence — your compliance obligations remain your own.

Questions a security review needs answered that aren't on this page? Email us — the answer will be added here.