Your trust stays yours.
Share the proof, not everything behind it. Policies, disclosure paths, and compliance progress.
Trust areas
Security, privacy, and compliance.
Report a vulnerability through our disclosure policy, review how Proofable handles privacy, or request access to compliance materials still in progress.
Security
Controlled access, abuse prevention, and a private channel for vulnerability reports.
Privacy
Trust records stay private by default. Public sharing is intentional and limited to what you choose to share.
Compliance
Smart contract audit is complete. Platform security review and SOC 2 are in progress.
Data and privacy
Privacy-first data sharing.
Proofable helps products check trust while asking users to share only necessary information.
- Proofable never needs your private keys or recovery phrase.
- Sharing controls stay with the user or product that creates the record.
- Private records stay visible only to approved viewers.
- Support and contact forms only ask for the details needed to respond.
Reports and policies
Documents and status.
Open available documents now. In-progress items stay listed so you can request access.
- Request reportSmart contract security auditComplete
SafeStack AI completed the review in March 2026. No critical, high, medium, or low severity findings.
- ViewBenchmarks and public recordsAvailable
Eight permission cases on the live service, each with a public signed record, and what each check costs.
- Request accessPlatform security reviewIn progress
Review of the hosted platform, separate from the completed smart contract audit.
- Request accessSOC 2In progress
Request status or early access under NDA.
- ViewSecurity disclosure policyAvailable
How to report vulnerabilities privately.
- ViewPrivacy policyAvailable
How Proofable describes privacy and user data.
- ViewTerms of useAvailable
Product and service terms.
Data handling
What is stored, and what is not.
The record of a check and the evidence behind it are different things. Proofable stores the record.
- Proof records store what was verified, the owner, the status, and the expiry. The documents behind a proof stay with the source system.
- Proofs are private by default. Public visibility is an explicit owner choice, and private records remain visible only to approved viewers.
- A proof carries its result, never the underlying evidence: an identity proof does not expose the passport, a wallet proof does not expose keys.
- Owners can revoke a proof. Revocation is immediate and the next check fails closed.
Agent security
How agent authority is bounded.
Identity, delegation, policy boundaries, secret handling, and refusal behavior in the shipped agent runtime.
- Every agent has a verifiable identity with an owner behind it. A receiving system can check who is acting and who it acts for.
- Permissions are set before the agent acts: allowed actions, spend caps, end dates. A blocked action always wins over an allowed one.
- A missing or expired permission fails closed. Irreversible actions can require a person to approve them first.
- Server keys never enter chats. Secrets live in the vault and are referenced, not pasted.
- Checked actions leave a receipt: the agent, its owner, the policy, and the result.
Standards
What is actually implemented.
Only the specs this product ships, not the ones it watches.
- CAIP-380 (Portable Proof)
The Draft Portable Proof specification for carrying a verified result between chains, apps, and agents. Authored by Proofable and implemented in production.
- ERC-8004 (prepared)
Agent registration descriptors are published in the ERC-8004 prepared shape for interoperability.
- A2A Agent Card (v1.0)
Per-agent A2A cards are served at the registered well-known URI.
- EIP-191 signing
Off-chain auth uses EIP-191 with a standardized message. Smart accounts validate via EIP-1271/6492.
Resources
Find the right document.
Security, privacy, and product docs. Contact Proofable for SOC 2 or platform review status.
Need more information?
Contact Proofable for security, privacy, partner, or enterprise questions, including SOC 2 and platform security review status. Vulnerability reports should use the disclosure path.