The public bar for a trustworthy software or AI company.
Named, versioned, free to check against, and every requirement witnessed. Self-attestation counts for nothing here. A company either meets the Trooth Standard or it does not, and its standing stays alive: re-witnessed continuously, lapsing automatically if the evidence drifts.
Version 1.0 · 14 requirements · 4 pillars
For buyers · the one line to paste into a vendor policy
Vendors must meet the Trooth Standard (trooth.co/standard) at onboarding and maintain it for the term.
The moment the bar lives inside your paperwork, every vendor knows exactly what clear means, and Trooth keeps witnessing it for you. Buyer-side review criteria live in the Buyer Review Standard.
The bar: 14 requirements in 4 pillars
Pillar I
Identity
Verified: who they are. A real, identified person stands behind the company, and someone checked. Identity is verified once and stands; everything below it is witnessed with a date.
01
Domain control witnessed
The company proves control of its primary domain through a DNS challenge or equivalent.
02
Founder identity confirmed
At least one named human founder or officer completes identity confirmation and publicly stands behind the company on its profile.
03
Repository provenance witnessedSoftware and AI companies
The GitHub organizations and repositories the company claims are provably controlled by the identified founders. The claimed code belongs to the claimed humans.
Pillar II
Security floor
The outside-in minimum every serious company can meet, witnessed from live public surfaces.
04
TLS everywhere, correctly configured
Current, strong TLS on all public product and marketing surfaces.
05
Security headers baseline
HSTS and a content-security posture present on public surfaces.
06
Email authentication at enforcement
SPF, DKIM, and DMARC with policy at quarantine or reject on the primary domain.
07
security.txt published
A reachable security.txt with a working security contact.
08
No exposed secrets
No API keys, credentials, or private endpoints detectable on public surfaces, including public repositories.
Pillar III
Transparency
What a buyer can read before ever asking. Published, reachable, and witnessed present.
09
Privacy policy and terms published
Both reachable from the root domain.
10
Sub-processor register published
A public register of the third parties that touch customer data.
11
AI disclosure publishedCompanies shipping AI
A model card or AI fact sheet naming the models used, the providers customer data flows to, and whether customer data trains models.
12
Vulnerability disclosure policy published
A stated, reachable way to report a security issue.
Pillar IV
Continuity
Alive, contestable, and honest. The part a point-in-time audit can never give you.
13
Continuous witnessing active
The profile is re-witnessed on the standard cadence. A break in witnessing lapses the standing rather than freezing it.
14
The claims ledger is clean
Every claim on the profile carries its label: Witnessed, Confirmed, or Stated. A company may state what Trooth cannot witness; it may not state what Trooth witnessed to be false.
Pass semantics
Meets, lapses, recovers
Meets the Standard means every applicable requirement is witnessed true. Requirements 03 and 11 apply conditionally; a company they do not apply to is measured on the rest. When a requirement drifts, the standing shows Lapsed with the date and the failed requirement. Recovery is re-witnessing, not renegotiation, and standing changes propagate to badges and the API in seconds.
The weekend path
Reachable on purpose
Five requirements are template-fixable with Trooth's free templates, three are configuration, and the identity checks take minutes each. A competent two-person AI startup can meet the bar in a weekend. The meaning lives in it being witnessed and kept, not in it being exclusive.
Scope, stated plainly
What the Standard is not
Not a certificationTrooth witnesses and shows its work. It does not certify, guarantee, or sign on a company's behalf. Trooth automates. Trooth never signs.
Not a scoreThe witnessed score measures depth beyond the bar. The Standard is the binary floor a company meets or does not.
Not opinionNo reviews, no stars, no editorial judgment. Every requirement is observable.
Not financial diligenceFunding, valuation, and investor data are out of scope, permanently.
Not pay-gatedChecking against the Standard is free. Meeting it is free. Standing is never for sale.
Versioning
The bar only moves in public
The Standard is versioned in public. Requirements are only added or tightened in a new version, with a published migration window, so no company's standing changes without notice. Version history stays public, permanently.
Check your company against the Standard, free.
Free to check. Free to meet. Witnessed continuously. Standing never for sale.