Independent verification for software claims
Companies say things about their software. Attestr turns each claim into a test, runs it against evidence the company doesn’t control, signs the result, and puts it in a public log — so you don’t have to take anyone’s word for it. Including ours.
Six steps. You can perform the last one yourself.
A sentence like “we never log your SSN” becomes a versioned claim definition with an ID, the evidence it needs, and an explicit list of what it does not cover. Free text is never the thing being verified.
Source at a commit hash. Records straight from the payment processor. Probes Attestr runs itself. Every piece of evidence records who supplied it.
A pure function of evidence and parameters — no database, no network. The same code runs in our server and in the command-line tool you can run yourself.
The outcome, its coverage and its exceptions, as an in-toto statement in a DSSE envelope signed with Ed25519. No absolute paths, no secrets, no personal data.
Every attestation is appended to a Merkle transparency log. Checkpoints are published on a schedule and kept forever, so the log cannot quietly change.
In your browser or on your own machine: check the signature, check the inclusion proof, check that the log has only grown. Our API never tells you something is valid — it hands you the data and the proofs.
Each pack is one kind of evidence and one family of evaluators. Two are available today; the rest are described in the standard and not yet built.
“Sensitive values are never logged or written to a database.”
A static analyzer parses the Rust source — it never builds or runs it — and reports every place a value marked sensitive reaches a logging macro or a database write, with file and line.
“Every paid vote is counted exactly once.”
Nine claims, specified and frozen in the v0 standard. The transparency log, receipts and the browser verifier work today; the evaluators are being written now. Payment facts come from the processor, not the operator.
“Our site loads no third-party trackers.”
Evidence nobody else supplies: Attestr loads the page and records what it fetched. Trackers, cookies, TLS and security headers.
“This binary was built from that commit.”
Closes the gap the privacy-code pack names in its own limitations: source at a commit is not the binary you run.
“Deleted accounts are purged within 30 days.”
A statistical claim, and labelled as one.
You get a live page for each thing you’ve claimed, a badge you can put in your README or your marketing, and a report you can hand to a customer’s security review. What makes it worth more than a logo is that the person reading it can check it without asking you anything.
Claims that fail say so, and say exactly where. That is the point: a page that can only ever say “pass” is a page nobody believes.
hello@attestr.devThe engine is open source. The claim definitions, the evaluators, the log and the verifier all live in one repository, so “re-run it yourself” is a real instruction rather than a slogan.
claimer check runs the evaluators locally;claimer verify checks an attestation, a receipt or a consistency proof offline.# in your browser
open https://attestr.dev/verify/
# or offline, from source
git clone https://github.com/Attestr-dev/claimer
cargo run -p claimer -- verify attestation ./att.jsonSame code, same answer. If the two ever disagree, one of them is a bug and we want to hear about it.
An auditor you have to trust is just a second company making claims. Here is what we did about that.
Every attestation goes into a public append-only log. If we removed or changed one after the fact, the log’s consistency proof would fail, in your browser, against a checkpoint you already hold.
The code that decides pass or fail is published and versioned, and the attestation names the exact version that ran. Given the same evidence, you get the same bytes.
There is no "valid": true field anywhere in our API. It returns the document and the proofs; your client decides. A verdict you cannot re-derive is just our word again.
Missing evidence produces not evaluable, never a pass. Every outcome carries its coverage — files scanned, skipped and unparsed — and every claim carries its limitations.
No third-party requests, no cookies, no analytics, self-hosted fonts, a strict content security policy. Tests fail the build if that stops being true.
The sandbox lets you cheat as the operator and watch the claims catch it — including a button that makes Attestr itself rewrite history, so you can see the consistency check fail.