Delivery model

The instrument runs in your pipeline — not on a fleet of laptops.

TrueVectors is designed for a CI pipeline step or one server-side container in your environment. Checks run where your code and artifacts already live; only a metrics-only receipt can reach the Control Plane. The desktop app is an optional individual evaluation surface, not the enterprise install path.

Private development — public distribution is not open

The GitHub Action, container images, and desktop installers are not currently published for public use. This page documents the delivery model without promising an unavailable download. Follow the public audit record for independently reproducible evidence.

Recommended

Add the audit to CI

GitHub · GitLab · Bitbucket · Azure DevOps

When public distribution opens, your engineers will add one pipeline step. The same containerized engine runs against the checked-out workspace and produces a countersigned receipt on each release.

• Your artifacts stay in your environment. Only a metrics-only receipt (counts, hashes, verdict tiers — never source, data, paths, or prose) can be sent to the Control Plane.
• Full deterministic proof tier — zero-token, no API key.
• Connected deployments can use managed model access or your own provider.
• Authorized releases can include container or Helm delivery for VPC and self-hosted mandates; no public image or chart is currently published.

Read the delivery guide

Public Action and container references will appear here only after an authorized release.

Desktop evaluation

Optional wedge · not publicly distributed

A desktop surface remains useful for individual evaluation, but it is not the enterprise delivery path and no public installer is currently promised.

• Desktop signing and notarization are wedge-quality work, not enterprise blockers.
• No MDM, MSI, PKG, or per-OS allowlisting campaign is required for CI delivery.
• Any future installer will be labeled by OS, version, signature status, and checksum.
• Until then, there is intentionally no download button.

See the public audit record

Every published finding includes evidence you can inspect and re-run.

Where does the audit actually run?

TrueVectors separates three things, and only the auditor ever runs an audit:

Marketing

www.truevectors.ai

This site. No code, no audits.

Control plane

app.truevectors.ai

Your account, team, billing, and fleet history. It never runs an audit — it only receives the metrics-only receipt.

Auditor

your CI / VPC

The engine that does the work. It runs in the checked-out pipeline workspace or a container in your infrastructure — your artifacts stay there.

The privacy boundary (G-6). Whether you run locally or inside your own VPC, the control plane only ever stores an aggregate receipt — finding counts, severities, evidence tiers, cost, and hashed run/repo identifiers. Source code, file paths, finding prose, and prompts are never uploaded. Regulated buyers can run the sealed engine entirely inside their own VPC, with LLM calls kept on the AWS network via a Bedrock PrivateLink endpoint.

See how the checks work

The CLI, CI wrapper, and optional desktop surface drive the same engine. Public distribution is closed for now, but the architecture and reproducible audit evidence are documented.

See the audit recordRead the delivery guide

Private development. No public installer, Action, container image, or commercial availability is represented on this page.