Trust center
Trust should be inspectable.
Claims apply to the current public build · last reviewed 15 September 2026 · runtime evidence: Not independently published
Trust principles
Local by design
Local Mode is the default. The architecture is built so matter processing works with no vendor in the path.
Evidence over assertion
Findings carry the passage they came from. Claims on this site carry the page that supports them.
Human-controlled actions
The application proposes; counsel decides. No change is applied without a recorded human decision.
Inspectable architecture
The source is public under AGPL-3.0, and the tests that check the boundary are published for you to run.
The data boundary
In Local Mode, every stage of a matter task is designed to stay inside the Vaultr boundary — no vendor, no upload dialog, no silent fallback. The visualization below shows the flow, and the toggle shows exactly where it changes.
- Matter
- Parsing
- Local inference
- Evidence
- Human review
- Output
In Local Mode the six stages above stay inside the boundary: matter content, prompts, inference and outputs remain in the local Vaultr environment. Network exceptions are the ones you start on purpose — updates and model downloads.
Run the boundary test
Download the helper, freeze the release, run the fixed workflow, and inspect the evidence it leaves. This is a scoped way to test the boundary yourself — not a universal zero-egress certificate.
- Reviewed
- 15 September 2026
- Scope
- Current public build · Local Mode · one tested macOS configuration
- Runtime result
- Not independently published
- Boundary
- A test result must be tied to the release, hardware and workload that produced it.
The proof register
Each row is a claim, held to a stated scope, with the evidence that exists today and a status that does not overstate it. "Verified", "certified" and "audited" are not used on this page because that work has not been done yet — and the restraint is deliberate: it is what makes the register worth checking.
9 claims · statuses change when the evidence does, not when the marketing does
Open-source licence compliance
ISO/IEC 5230 concerns open-source licence compliance — Open-source licence compliance: the processes a programme uses to manage licence obligations across the software it ships. It is a governance standard, not an information-security certification, and nothing on this site describes it as one.
OpenChain Conformance — self-certification · September 2026
Vaultr's open-source licence compliance programme conforms to OpenChain ISO/IEC 5230 by self-certification. Self-certification is an officially supported conformance path under the OpenChain specification. It is a statement about our own programme processes — it is not an independent audit, and it is not an information-security certification.
- Licence inventory
- AGPL-3.0 for Vaultr itself, with upstream project licences documented in the repository.
- Obligation tracking
- Copyleft scope is stated in the security brief: internal firm use, with source obligations if third parties interact with a deployed instance.
- Provenance
- The public repository carries the licence text, the fork's upstream attribution and the review history.
Self-certification is an officially supported conformance path under the OpenChain specification — and we state it as exactly that. We publish the scope of what it covers rather than letting a badge imply more than it does; if we commission independent assurance, its result will appear here.
Responsible claims
The house rule
Security claims should have scope.
Benchmarks should have configurations.
Evidence should have provenance.
Where this site states a technical claim, it links to the methodology, the code or the demonstration that supports it. Where evidence does not yet exist, the register says "pending" rather than dressing the gap up as a guarantee.
Security contact
Reporting a security issue
Contact sabarinath.1805@gmail.com. Please do not include matter data or credentials in reports.
Open a security advisory on the public repositoryPublished: /.well-known/security.txtCheck it yourself
The strongest report is a reproduced one: run the boundary test, read the source, walk the register. Start with the security brief's verification procedure.