The public bar for a trustworthy software or AI company.

Named, versioned, free to check against, and every requirement witnessed. Self-attestation counts for nothing here. A company either meets the Trooth Standard or it does not, and its standing stays alive: re-witnessed on the published cadence, lapsing automatically if the evidence drifts.

For buyers · the one line to paste into a vendor policy

Vendors must meet the Trooth Standard (trooth.co/standard) at onboarding and maintain it for the term.

The moment the bar lives inside your paperwork, every vendor knows exactly what clear means, and Trooth keeps witnessing it for you. Buyer-side review criteria live in the Buyer Review Standard.

The bar: 14 requirements in 4 pillars

Pillar I

Identity

Confirmed: who they are. A real, identified person stands behind the company, and someone checked. Identity is confirmed once and stands; everything below it is witnessed with a date.

01
Domain control witnessed
The company proves control of its primary domain through a DNS challenge or equivalent.
02
Founder identity confirmed
At least one named human founder or officer completes identity confirmation and publicly stands behind the company on its profile.
03
Repository provenance witnessedSoftware and AI companies
The GitHub organizations and repositories the company claims are provably controlled by the identified founders. The claimed code belongs to the claimed humans.

Pillar II

Security floor

The outside-in minimum every serious company can meet, witnessed from live public surfaces.

04
TLS everywhere, correctly configured
Current, strong TLS on all public product and marketing surfaces.
05
Security headers baseline
HSTS and a content-security posture present on public surfaces.
06
Email authentication at enforcement
SPF, DKIM, and DMARC with policy at quarantine or reject on the primary domain.
07
security.txt published
A reachable security.txt with a working security contact.
08
No exposed secrets
No API keys, credentials, or private endpoints detectable on public surfaces, including public repositories.

Pillar III

Transparency

What a buyer can read before ever asking. Published, reachable, and witnessed present.

09
Privacy policy and terms published
Both reachable from the root domain.
10
Sub-processor register published
A public register of the third parties that touch customer data.
11
AI disclosure publishedCompanies shipping AI
A model card or AI fact sheet naming the models used, the providers customer data flows to, and whether customer data trains models.
12
Vulnerability disclosure policy published
A stated, reachable way to report a security issue.

Pillar IV

Continuity

Alive, contestable, and honest. The part a point-in-time audit can never give you.

13
Witnessing still active
Each fact on the profile is re-witnessed inside its own published window. A break in witnessing lapses the standing rather than freezing it.
14
The claims ledger is clean
Every claim on the profile carries its label: Witnessed, Confirmed, or Stated. A company may state what Trooth cannot witness; it may not state what Trooth witnessed to be false.

Pass semantics

Meets, lapses, recovers

Meets the Standard means every applicable requirement is witnessed true. Requirements 03 and 11 apply conditionally; a company they do not apply to is measured on the rest. When a requirement drifts, the standing shows Lapsed with the date and the failed requirement. Recovery is re-witnessing, not renegotiation. A standing change reaches the API and the badge on the next cache read, within five minutes, and up to fifteen minutes where an edge copy is still being served while it revalidates.

The weekend path

Reachable on purpose

Five requirements are template-fixable with Trooth's free templates, three are configuration, and the identity checks take minutes each. A competent two-person AI startup can meet the bar in a weekend. The meaning lives in it being witnessed and kept, not in it being exclusive.

Scope, stated plainly

What the Standard is not

Not a certificationTrooth witnesses and shows its work. It does not certify, guarantee, or sign on a company's behalf. Trooth automates. Trooth never signs.
Not a scoreThere is no number and no ranking. The Standard is the binary floor a company meets or does not.
Not opinionNo reviews, no stars, no editorial judgment. Every requirement is observable.
Not financial diligenceFunding, valuation, and investor data are out of scope, permanently.
Not pay-gatedChecking against the Standard is free. Meeting it is free. Standing is never for sale.

Versioning

The bar only moves in public

The Standard is versioned in public. Requirements are only added or tightened in a new version, with a published migration window, so no company's standing changes without notice. Version history stays public, permanently.

Check your company against the Standard, free.

Free to check. Free to meet. Witnessed on a published cadence. Standing never for sale.

Claim your company page Read the Terms