{
  "spec": "rs-trust-controls/1",
  "as_of": "2026-11-06T04:56:44.726Z",
  "summary": {
    "operating": 11,
    "partial": 2,
    "attention": 0,
    "not_in_place": 0,
    "total": 13
  },
  "controls": [
    {
      "id": "RS-LED-1",
      "area": "Record integrity",
      "title": "Append-only, hash-chained, signed ledger",
      "what": "Every recorded check, approval and action is hash-chained, sealed into Ed25519-signed Merkle blocks, and never edited or deleted.",
      "state": "operating",
      "evidence": "Chain re-verified at read: valid. 15,250 entries in 3,838 blocks. Issuer key key_41eb7b6d1b11968a.",
      "links": [
        {
          "label": "Verify the whole ledger",
          "href": "/v1/ledger/verify"
        },
        {
          "label": "Verify a record",
          "href": "/verify"
        }
      ],
      "frameworks": [
        "SOC 2 CC7.2, PI1.4",
        "ISO 27001 A.5.33, A.8.15, A.8.24",
        "ISO 42001 A.6.2.8",
        "EU AI Act Art. 12, Art. 19, Art. 26(6)",
        "NIST AI RMF MANAGE 4.1"
      ]
    },
    {
      "id": "RS-LED-2",
      "area": "Record integrity",
      "title": "Public timestamp anchoring",
      "what": "Block fingerprints are published to the Bitcoin blockchain through OpenTimestamps, so history cannot be quietly rewritten afterward.",
      "state": "operating",
      "evidence": "Anchoring ok; confirmed through block 3,800.",
      "links": [
        {
          "label": "Anchor proofs",
          "href": "/docs/anchors"
        }
      ],
      "frameworks": [
        "SOC 2 PI1.4",
        "ISO 27001 A.5.33, A.8.24"
      ]
    },
    {
      "id": "RS-LED-3",
      "area": "Record integrity",
      "title": "Independent witness co-signing (finality)",
      "what": "Unaffiliated operators co-sign block heads; entries in witnessed, anchored blocks are final, settled by parties other than the service.",
      "state": "partial",
      "evidence": "Confirmed unaffiliated witnesses: 0 of 2 required. Until the quorum is met, records reach \"anchored\", not \"final\".",
      "links": [
        {
          "label": "Witnesses",
          "href": "/witnesses"
        }
      ],
      "frameworks": [
        "SOC 2 PI1.4",
        "ISO 27001 A.5.33"
      ]
    },
    {
      "id": "RS-KEY-1",
      "area": "Keys and custody",
      "title": "Signing-key succession by threshold",
      "what": "A signing-key change takes effect only through a sealed plan naming three successor keys, a public challenge window, and two of three successors signing.",
      "state": "partial",
      "evidence": "Rule live: 2 of 3 successors, with a timelocked challenge window. Plan state: none announced.",
      "links": [
        {
          "label": "Status",
          "href": "/status"
        }
      ],
      "frameworks": [
        "SOC 2 CC6.1",
        "ISO 27001 A.5.17, A.8.24"
      ]
    },
    {
      "id": "RS-CHG-1",
      "area": "Change and incidents",
      "title": "Recorded releases with automatic rollback",
      "what": "Every release is recorded on the ledger with its commit; each new build is judged by a smoke battery and rolled back automatically on a confirmed regression.",
      "state": "operating",
      "evidence": "127 releases recorded in the last 30 days. Current build verdict: pass; 23 builds judged.",
      "links": [
        {
          "label": "Release record",
          "href": "/transparency/changes"
        }
      ],
      "frameworks": [
        "SOC 2 CC8.1",
        "ISO 27001 A.8.32"
      ]
    },
    {
      "id": "RS-INC-1",
      "area": "Change and incidents",
      "title": "Self-filed incidents",
      "what": "Failing checks file sealed incident records automatically, with exceptions-only paging, so an unattended system reports its own faults.",
      "state": "operating",
      "evidence": "Sealing ok; storage ok; webhooks ok.",
      "links": [
        {
          "label": "Status and history",
          "href": "/status"
        }
      ],
      "frameworks": [
        "SOC 2 CC7.3, CC7.4",
        "ISO 27001 A.5.24, A.5.25, A.5.26"
      ]
    },
    {
      "id": "RS-ACC-1",
      "area": "Access",
      "title": "Every operator action is public",
      "what": "Each use of operator power is sealed on the public ledger as an operator action (operation and a path hash). Delegated read keys can read, never change.",
      "state": "operating",
      "evidence": "10 operator actions sealed in the last 30 days.",
      "links": [
        {
          "label": "Operator actions",
          "href": "/v1/operator-actions"
        }
      ],
      "frameworks": [
        "SOC 2 CC6.1, CC6.3",
        "ISO 27001 A.5.15, A.8.15"
      ]
    },
    {
      "id": "RS-ABU-1",
      "area": "Abuse and attack surface",
      "title": "Scanner tripwires, adaptive limits and proof-of-work",
      "what": "Scanner probes and wrong operator credentials are recorded by category against hashed networks; flagged networks must solve proof-of-work to register; abusive accounts are quarantined with an appeal path.",
      "state": "operating",
      "evidence": "21 tripwire events in the last 24 hours (categories and hashed networks only).",
      "links": [
        {
          "label": "Security",
          "href": "/security/spec"
        }
      ],
      "frameworks": [
        "SOC 2 CC6.6, CC7.2",
        "ISO 27001 A.8.16"
      ]
    },
    {
      "id": "RS-MNY-1",
      "area": "Money controls",
      "title": "Fees in shadow mode behind circuit breakers",
      "what": "Fees are computed and sealed but never executed until arbitration readiness and an explicit operator decision; per-transaction and daily caps trip an automatic pause.",
      "state": "operating",
      "evidence": "Fee mode: shadow. Circuit breaker: closed.",
      "links": [
        {
          "label": "Money status",
          "href": "/v1/money/status"
        },
        {
          "label": "Pricing",
          "href": "/pricing"
        }
      ],
      "frameworks": [
        "SOC 2 PI1.2",
        "ISO 27001 A.8.32"
      ]
    },
    {
      "id": "RS-PRV-1",
      "area": "Privacy",
      "title": "Public records pass anonymity checks before sealing",
      "what": "Public-facing records stage privately and pass schema, lint, anonymity and drift checks before they seal; public surfaces show aggregates only.",
      "state": "operating",
      "evidence": "Checks: schema, lint, anonymity, drift. Staged now: 0.",
      "links": [
        {
          "label": "Privacy",
          "href": "/privacy"
        }
      ],
      "frameworks": [
        "SOC 2 C1.1, P4.1",
        "ISO 27001 A.5.34, A.8.11"
      ]
    },
    {
      "id": "RS-OPS-1",
      "area": "Customer evidence",
      "title": "Supervision evidence a customer can hand over",
      "what": "Workspaces record agent actions with durable receipts, evaluate policies on a schedule, route exceptions to human review, send signed alerts to the customer's systems, and issue signed, hash-chained weekly statements a reviewer can verify without an account.",
      "state": "operating",
      "evidence": "Available to every workspace. Live workspaces: 0; signed statements issued: 0; active alert endpoints: 0.",
      "links": [
        {
          "label": "Operations",
          "href": "/operations"
        }
      ],
      "frameworks": [
        "EU AI Act Art. 12, Art. 14, Art. 26(5), Art. 26(6)",
        "ISO 42001 A.6.2.6, A.6.2.8",
        "NIST AI RMF MANAGE 4.1",
        "SOC 2 CC7.2"
      ]
    },
    {
      "id": "RS-AVL-1",
      "area": "Availability",
      "title": "Durable storage and replicated checkpoints",
      "what": "Records are kept on durable storage; signed checkpoints of the ledger head are replicated beside the database and published daily.",
      "state": "operating",
      "evidence": "Storage ok. Daily snapshot published.",
      "links": [
        {
          "label": "Ledger snapshot",
          "href": "/v1/ledger/snapshot"
        }
      ],
      "frameworks": [
        "SOC 2 A1.2",
        "ISO 27001 A.8.13, A.8.14"
      ]
    },
    {
      "id": "RS-VUL-1",
      "area": "Abuse and attack surface",
      "title": "Vulnerability disclosure",
      "what": "A published security contact and disclosure policy; security changes are recorded and dated.",
      "state": "operating",
      "evidence": "security.txt published; security changes listed.",
      "links": [
        {
          "label": "security.txt",
          "href": "/.well-known/security.txt"
        },
        {
          "label": "Security changes",
          "href": "/security/changes"
        }
      ],
      "frameworks": [
        "SOC 2 CC7.1",
        "ISO 27001 A.8.8"
      ]
    }
  ],
  "gaps": [
    {
      "gap": "Independent witness quorum",
      "status": "0 of 2",
      "closes_when": "Two unaffiliated operators confirm and co-sign block heads; records then reach the final rung."
    },
    {
      "gap": "Designated successor keys",
      "status": "none announced",
      "closes_when": "The owner announces a sealed plan naming three successor keys."
    },
    {
      "gap": "Third-party attestation",
      "status": "None held",
      "closes_when": "An independent auditor issues a report. Until then, every control here is evidenced by its live reading, not by an attestation."
    }
  ],
  "not_claimed": [
    "No SOC 2 report, ISO/IEC 27001 or ISO/IEC 42001 certificate, or third-party audit opinion is held or implied.",
    "Framework references show where a control can support a customer's own evidence. They are the service's mapping, not a determination that any requirement is met.",
    "Records prove what was submitted and when, and that it has not changed since. They do not prove that a self-reported action actually happened.",
    "Nothing here is legal advice."
  ]
}