# How Trooth witnesses trust Canonical page: https://trooth.co/methodology Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. It reports a company's current record across fourteen categories (Company identity, Company history, Company & funding, Product offering & demos, Commercial & pricing, Integrations & stack, Security, Privacy, AI practices, Data & hosting, Infrastructure & latency, Procurement, Relationships, Customer proof) and labels every fact by where it came from: domain control shown and a representative's attestation recorded, facts Trooth witnessed from live evidence, claims a named counterparty attested, and what the company states about itself, always shown as its own words. - Witnessed means backed by live reads of connected systems, hash-linked and signed on an audit chain, and re-checked on a schedule. - An outside-in read is a live, neutral observation of a domain's public surface (HTTPS reachability, common response headers, security.txt). It is not witnessed evidence and not a grade. - Where a fact is unknown, Trooth shows it as unknown. It never invents a number. ## Provenance labels Every Trooth answer carries a label so a reader never mistakes an observation for a proof. - Witnessed: a fact Trooth observed itself, with the source, the method and the date of the reading. It is an observation of that source at that time, not a finding that the company is safe or compliant. - Public record: read from an authoritative public or registry source, not from the company. - Attested: a named counterparty declared it under its own name. Trooth records the declaration; it does not establish it. - Declared: the company stated it. Trooth records the declaration rather than establishing it, and signing or publishing a declaration does not make it witnessed. - Signed reading (listing state, provenance value signed_scan): a point-in-time signed reading, re-read on a schedule. Not self-reported, and not a rank. - Outside-in read: a live, neutral read of a domain's public surface right now. An observation of what was served, not witnessed evidence and not a grade. - Trust Ledger Token: a portable, signed receipt whose signatures anyone can validate independently. Trooth's signature covers the signing event, not the claim bytes, which the issuing company's own signature covers, never the truthfulness of the claims. - Honest absence: no data. An absence, not a judgment. Trooth automates the reading and signs the event. Trooth never signs on a company's behalf. ## Reading a company record Every company's record is read with the same words, on its page, in its text twin (https://trooth.co/network/company/.md) and in its JSON record. They are defined here once. Provenance words, one per section and one per fact: - witnessed: Trooth observed it at the time shown. Cite it as Trooth's observation, with that time. - public record: Trooth read it from the public registry or source named. Cite that source. - attested: A named counterparty stated it. Cite that counterparty. - declared: The company stated it; Trooth publishes it as written and does not establish it. Cite it as the company's statement, with its date. Three negative answers, never shown as one another: - No: the record holds a negative value. - Not published: the company has not published it on this record. - Not read: Trooth's reading did not read it. Section guidance. Section guidance comes from one template, keyed on each section's state and provenance. It is the same for every company, and no company can edit it. - published, declared:
: published, declared. The company stated it; Trooth publishes it as written and does not establish it. Cite it as the company's statement, with its date. - published, witnessed:
: published, witnessed. Trooth observed it at the time shown. Cite it as Trooth's observation, with that time. - published, public record:
: published, public record. Trooth read it from the public registry or source named. Cite that source. - published, attested:
: published, attested. A named counterparty stated it. Cite that counterparty. - published, mixed:
: published. Each group carries its own provenance label. - not published:
: not published on this record. - on request:
: available on request. The record shows that documents exist, not their contents. - hidden by the company:
: hidden from the page by the company. The record carries no values for it. - unavailable on this load:
: could not be read on this load. That is not the same as not published. Notes that apply to every company's record (the text twin links here instead of repeating them): - Declared by the company. Trooth has not tested these connections and does not witness them. - Package locations as published. Trooth does not confirm or scan them; check the publisher name before installing. - Targets and measured restores are both declared. Trooth does not run or witness these tests. - List pricing as the company states it, not a negotiated price. Trooth does not witness pricing. - This is the list as published today: new and old processors look alike, and removed ones are gone. If you need notice of a new sub-processor, that notice comes from the company, not from this page. - Documents stay behind a request: the Trust Profile shows that they exist, never their contents. Ask the company for access from its Trust Profile. - Trooth has a signed witness statement for this company's public surface. The signature covers the reading, not the truth of each claim. - These are statements model providers make about their own services. A provider's default, a paid plan's terms and a negotiated contract are three different things, and a provider assurance may be any of them, so none of this establishes how this company's own deployment is configured. Ask for that separately. - Published by the sources named, not by this company and not by Trooth. Each entry says what its source said and on what date, in the source's own stage word - an allegation, a finding, a settlement, an appeal and a final judgment are five different things, and Trooth does not summarize them into one. Nothing here is Trooth's conclusion about the company, and an entry is not evidence that an allegation is true. These entries stay on the record through a change of ownership; the company can answer any of them, and its answer appears beside the entry. - Published by the company, for the period each figure names, computed the way each figure says. Trooth does not audit these, does not compute them, and does not estimate any of them from a funding round or a headcount. Two companies can compute the same metric differently, so a figure here is comparable with another company's only if their definitions agree. The four kinds of infrastructure statement: - The company's description: The company describing its own architecture. Nobody outside can check it, and it is useful anyway - a wrong answer here is checkable against everything else on the page. - A contractual commitment: A contractual target with a remedy attached. Not a measurement: it says what the company owes you if it misses, not what it achieved. - The provider's own incident report: The provider's account of its own outages. It is the account with the strongest reason to be generous, and it is usually the only one that exists. - A measurement somebody took: Somebody took a reading. This is the only lane that is evidence, and only where it says who measured, from where, and how often. Each fact has a stable identifier, its section and its field in lower snake case (security.mfa_availability), with an anchor on the company's page (#fact-security-mfa_availability), and is printed as one sentence carrying who said it and when. Twelve standard buyer questions are answered only from the record's own fields; a question the record does not hold reads "Not published on this record." A declared fact's edit history is the difference between consecutive stored versions of the record. ## For AI agents - MCP endpoint (JSON-RPC 2.0, streamable HTTP): https://api.trooth.co/public/mcp - Descriptor (Trooth's own, not an MCP convention): https://trooth.co/.well-known/mcp.json - OpenAPI: https://trooth.co/openapi.json - Verify a signed claim, no login: https://trooth.co/verify/keys/keys - The agent pattern: https://trooth.co/docs/agents - ChatGPT app directory listing: https://chatgpt.com/plugins/plugin_asdk_app_6a9361d2ee7481919a8c706c3ff5388f