Evidence layer, not a certificate
Compliance-ready evidence.
Every audit is sealed into a tamper-evident, signed ledger, and high-severity unverified findings can be gated on a recorded human review. We map these to the frameworks your program already reports against — as evidence you consume, not a certification we issue.
Read this first. TrueVectors is not a SOC 2 report, an EU conformity assessment, an ISO/IEC 42001 certificate, or a correctness guarantee. It produces the artifacts — signed run records, evidence-tier-labeled findings, and oversight gates — that your own compliance program relies on. We sell reasonable assurance, never a guarantee, and we are explicit about what we do and don't cover.
What TrueVectors gives your auditor
Tamper-evident attestation
Each run is sealed into an append-only, hash-chained ledger and signed with a local Ed25519 key. Verify any run offline — no server, no trust required.
Enforceable human oversight
An opt-in CI gate in the EU AI Act Art. 14 style: critical / high findings the engine could not prove must carry a recorded reviewer disposition before the check passes.
Standards crosswalks
Control mappings with explicit gap columns for EU AI Act (Arts. 12–14), ISO/IEC 42001, NIST AI RMF, and SOC 2 — written for your auditor, honest about what we do and don't cover.
Standards crosswalk
Each row states the evidence TrueVectors produces and, just as plainly, the gap — the part that remains your program's responsibility, not something we certify.
| Framework | Evidence TrueVectors produces | Gap — what it does not do |
|---|---|---|
| EU AI Act (Arts. 12–14) | Record-keeping (Art. 12) via the signed run ledger; transparency (Art. 13) via evidence-tier-labeled findings; human oversight (Art. 14) via the enforceable review gate. | We do not perform a conformity assessment, issue a CE marking, or determine your system's risk class. |
| ISO/IEC 42001 (AI management system) | Operational evidence for AI-system monitoring, logging, and review controls. | We are not an accredited certification body; an ISO/IEC 42001 certificate comes from your auditor, not from us. |
| NIST AI RMF | Artifacts that support the Measure and Manage functions — measured findings, evidence tiers, and a durable record of dispositions. | We do not author your risk-management framework or attest organizational governance (Govern / Map). |
| SOC 2 | Evidence for change-management and monitoring controls: signed, time-stamped run records and recorded reviewer sign-off. | TrueVectors is not a SOC 2 report and does not replace your service auditor's examination. |
Honest by design
The same discipline that governs the engine governs this page: "proved" is used only for the proved tier, results are reported misses-first, and we never claim a certification we don't issue. The evidence is reproducible and the gaps are stated out loud — because credibility is built by showing your work, not by gatekeeping it.
✔ Ed25519-signed run ledger
✔ Enforceable oversight gate
✔ Crosswalks with gap columns
— Not a certificate we issueHand your auditor evidence, not adjectives.
For an authorized CI-first evaluation, TrueVectors can produce a durable, signed record of what was proved, what was corroborated, and what a human reviewed. Evidence you consume — never a certification we issue.
TrueVectors produces the evidence your compliance program relies on. Trust through proof.