{
  "standard": "Trooth Standard",
  "version": "1.0",
  "mappingVersion": "1.0.1",
  "published": "2026-09-26",
  "revised": "2026-09-27",
  "maintainedBy": "Trooth, LLC",
  "externalReview": "None. The Standard and this mapping are maintained by Trooth and have not been reviewed by an outside body.",
  "revisions": [
    {
      "mappingVersion": "1.0.0",
      "date": "2026-09-26",
      "change": "First published: the 100 checks in a reading, each mapped to a requirement or marked unmapped."
    },
    {
      "mappingVersion": "1.0.1",
      "date": "2026-09-27",
      "change": "Requirement TS-1.0-08 retitled from “No exposed secrets” to “No secrets detected in the checked sources”, so the title says what the checks cover. No check was added, removed or remapped."
    }
  ],
  "note": "Maps each of the 100 check identifiers in a Trooth reading to the Standard's 14 requirements. A requirement is never marked met or failed as a whole: the record shows each check's observed outcome beside the requirement it belongs to. A check marked unmapped is read and reported, and belongs to no requirement. An attest check is the company's declaration, recorded and not witnessed. Nothing here is an external certification. A change to a requirement or to this mapping creates a new mappingVersion; an existing reading is never reinterpreted under a newer mapping.",
  "requirements": [
    {
      "id": "TS-1.0-01",
      "title": "Domain control witnessed",
      "checks": [],
      "note": "Established by the claim flow before publication (a DNS TXT record or a code sent to an address at the domain), not by a check in the reading."
    },
    {
      "id": "TS-1.0-02",
      "title": "Representative attestation recorded",
      "checks": [
        "B2"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-03",
      "title": "Repository provenance witnessed",
      "checks": [],
      "note": "Established from GitHub organizations the company connects in its workspace, not by a check in the public reading. Conditional: software and AI companies."
    },
    {
      "id": "TS-1.0-04",
      "title": "TLS everywhere, correctly configured",
      "checks": [
        "S2"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-05",
      "title": "Security headers baseline",
      "checks": [
        "S2",
        "S11",
        "S15"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-06",
      "title": "Email authentication at enforcement",
      "checks": [
        "B17",
        "B18"
      ],
      "note": "The reading checks SPF and DMARC records. DKIM is not read, because a DKIM selector cannot be discovered from outside; the requirement's DKIM part is not evaluated."
    },
    {
      "id": "TS-1.0-07",
      "title": "security.txt published",
      "checks": [
        "S1",
        "I14",
        "I15"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-08",
      "title": "No secrets detected in the checked sources",
      "checks": [
        "S17",
        "S18",
        "S4"
      ],
      "note": "S4 is the company's attestation that its public repository holds no secrets; Trooth does not read repositories for secrets in the public reading."
    },
    {
      "id": "TS-1.0-09",
      "title": "Privacy policy and terms published",
      "checks": [
        "L1",
        "L2"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-10",
      "title": "Sub-processor register published",
      "checks": [
        "L13"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-11",
      "title": "AI disclosure published",
      "checks": [
        "A1",
        "A16",
        "A20"
      ],
      "note": "Conditional: companies shipping AI. A20 is the company's attestation."
    },
    {
      "id": "TS-1.0-12",
      "title": "Vulnerability disclosure policy published",
      "checks": [
        "S7",
        "S9"
      ],
      "note": null
    },
    {
      "id": "TS-1.0-13",
      "title": "Witnessing still active",
      "checks": [],
      "note": "A property of the record, not of one reading: each witnessed fact's freshness window, shown on the profile."
    },
    {
      "id": "TS-1.0-14",
      "title": "The claims ledger is clean",
      "checks": [],
      "note": "A property of the record: every claim carries its origin label. Not a check in the reading."
    }
  ],
  "checks": [
    {
      "id": "A1",
      "category": "ai",
      "kind": "probe",
      "title": "Model card published",
      "requirements": [
        "TS-1.0-11"
      ],
      "status": "mapped"
    },
    {
      "id": "A2",
      "category": "ai",
      "kind": "probe",
      "title": "Training data hygiene statement",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A3",
      "category": "ai",
      "kind": "attest",
      "title": "Eval baseline declared",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A4",
      "category": "ai",
      "kind": "probe",
      "title": "Human oversight position documented",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A5",
      "category": "ai",
      "kind": "probe",
      "title": "Hallucination disclosure visible to users",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A6",
      "category": "ai",
      "kind": "attest",
      "title": "Prompt-injection defense documented",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A7",
      "category": "ai",
      "kind": "attest",
      "title": "AI agent capability disclosure",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A8",
      "category": "ai",
      "kind": "attest",
      "title": "AI-specific incident response runbook",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A9",
      "category": "ai",
      "kind": "probe",
      "title": "Synthetic media labeling policy",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A10",
      "category": "ai",
      "kind": "attest",
      "title": "Red-team testing log maintained",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A11",
      "category": "ai",
      "kind": "probe",
      "title": "Training-data provenance addressed",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A12",
      "category": "ai",
      "kind": "probe",
      "title": "AI misuse reporting channel published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A13",
      "category": "ai",
      "kind": "probe",
      "title": "AI-generated content disclosure stated",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A14",
      "category": "ai",
      "kind": "probe",
      "title": "llms.txt published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A15",
      "category": "ai",
      "kind": "probe",
      "title": "AI crawler policy declared in robots.txt",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A16",
      "category": "ai",
      "kind": "probe",
      "title": "Customer-data training stance disclosed",
      "requirements": [
        "TS-1.0-11"
      ],
      "status": "mapped"
    },
    {
      "id": "A17",
      "category": "ai",
      "kind": "attest",
      "title": "Human oversight for high-impact decisions",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A18",
      "category": "ai",
      "kind": "attest",
      "title": "Model eval / red-team within 90 days",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A19",
      "category": "ai",
      "kind": "attest",
      "title": "AI system inventory maintained",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "A20",
      "category": "ai",
      "kind": "attest",
      "title": "Foundation-model providers disclosed",
      "requirements": [
        "TS-1.0-11"
      ],
      "status": "mapped"
    },
    {
      "id": "B1",
      "category": "business",
      "kind": "attest",
      "title": "Entity active in its state or country registry",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B2",
      "category": "business",
      "kind": "attest",
      "title": "Founder identity attested",
      "requirements": [
        "TS-1.0-02"
      ],
      "status": "mapped"
    },
    {
      "id": "B3",
      "category": "business",
      "kind": "probe",
      "title": "Contact reachability",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B4",
      "category": "business",
      "kind": "probe",
      "title": "Uptime / SLA statement",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B5",
      "category": "business",
      "kind": "probe",
      "title": "Complaint channel published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B6",
      "category": "business",
      "kind": "probe",
      "title": "Status page or incident log",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B7",
      "category": "business",
      "kind": "attest",
      "title": "Customer support SLA documented",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B8",
      "category": "business",
      "kind": "probe",
      "title": "Pricing transparency (public pricing)",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B9",
      "category": "business",
      "kind": "probe",
      "title": "Refund / cancellation policy",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B10",
      "category": "business",
      "kind": "attest",
      "title": "Cyber liability insurance disclosure",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B11",
      "category": "business",
      "kind": "probe",
      "title": "Support contact discoverable",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B12",
      "category": "business",
      "kind": "probe",
      "title": "Status page linked",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B13",
      "category": "business",
      "kind": "probe",
      "title": "Pricing transparency",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B14",
      "category": "business",
      "kind": "probe",
      "title": "Legal entity named on site",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B15",
      "category": "business",
      "kind": "probe",
      "title": "SLA or uptime commitment stated",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B16",
      "category": "business",
      "kind": "probe",
      "title": "MX records present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B17",
      "category": "business",
      "kind": "probe",
      "title": "SPF record published",
      "requirements": [
        "TS-1.0-06"
      ],
      "status": "mapped"
    },
    {
      "id": "B18",
      "category": "business",
      "kind": "probe",
      "title": "DMARC record published",
      "requirements": [
        "TS-1.0-06"
      ],
      "status": "mapped"
    },
    {
      "id": "B19",
      "category": "business",
      "kind": "attest",
      "title": "Cyber liability insurance in force",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "B20",
      "category": "business",
      "kind": "attest",
      "title": "Critical sub-processors reviewed annually",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I1",
      "category": "ip",
      "kind": "attest",
      "title": "Founder IP assignment on file",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I2",
      "category": "ip",
      "kind": "attest",
      "title": "Third-party license inventory",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I3",
      "category": "ip",
      "kind": "probe",
      "title": "SBOM published (CycloneDX or SPDX)",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I4",
      "category": "ip",
      "kind": "attest",
      "title": "Trademark clearance check",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I5",
      "category": "ip",
      "kind": "probe",
      "title": "Copyright notice present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I6",
      "category": "ip",
      "kind": "attest",
      "title": "AI-generated-code disclosure",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I7",
      "category": "ip",
      "kind": "attest",
      "title": "Patent disclosure (filed patents listed)",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I8",
      "category": "ip",
      "kind": "attest",
      "title": "Trade secret protection statement",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I9",
      "category": "ip",
      "kind": "attest",
      "title": "Open-source contribution policy",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I10",
      "category": "ip",
      "kind": "attest",
      "title": "AI training data attribution disclosure",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I11",
      "category": "ip",
      "kind": "probe",
      "title": "Copyright notice is current",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I12",
      "category": "ip",
      "kind": "probe",
      "title": "DMCA / IP infringement contact published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I13",
      "category": "ip",
      "kind": "probe",
      "title": "Open-source notices addressed",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I14",
      "category": "ip",
      "kind": "probe",
      "title": "security.txt has Contact field",
      "requirements": [
        "TS-1.0-07"
      ],
      "status": "mapped"
    },
    {
      "id": "I15",
      "category": "ip",
      "kind": "probe",
      "title": "security.txt has valid Expires field",
      "requirements": [
        "TS-1.0-07"
      ],
      "status": "mapped"
    },
    {
      "id": "I16",
      "category": "ip",
      "kind": "probe",
      "title": "Brand/trademark notice present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I17",
      "category": "ip",
      "kind": "attest",
      "title": "Team IP assignment agreements on file",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I18",
      "category": "ip",
      "kind": "attest",
      "title": "OSS license compliance reviewed",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I19",
      "category": "ip",
      "kind": "attest",
      "title": "Trade-secret handling policy exists",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "I20",
      "category": "ip",
      "kind": "attest",
      "title": "No undisclosed IP litigation",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L1",
      "category": "legal",
      "kind": "probe",
      "title": "Privacy Policy published",
      "requirements": [
        "TS-1.0-09"
      ],
      "status": "mapped"
    },
    {
      "id": "L2",
      "category": "legal",
      "kind": "probe",
      "title": "Terms of Service published",
      "requirements": [
        "TS-1.0-09"
      ],
      "status": "mapped"
    },
    {
      "id": "L3",
      "category": "legal",
      "kind": "probe",
      "title": "Acceptable Use Policy published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L4",
      "category": "legal",
      "kind": "attest",
      "title": "EU AI Act risk class self-classified",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L5",
      "category": "legal",
      "kind": "probe",
      "title": "GDPR/CCPA data-subject contact published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L6",
      "category": "legal",
      "kind": "probe",
      "title": "Export-control statement present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L7",
      "category": "legal",
      "kind": "probe",
      "title": "AI Use Policy (employee-facing) published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L8",
      "category": "legal",
      "kind": "probe",
      "title": "Children's privacy disclosure (COPPA)",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L9",
      "category": "legal",
      "kind": "probe",
      "title": "Cookie consent / banner present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L10",
      "category": "legal",
      "kind": "probe",
      "title": "Cross-border data transfer mechanism documented",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L11",
      "category": "legal",
      "kind": "probe",
      "title": "Cookie disclosure present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L12",
      "category": "legal",
      "kind": "probe",
      "title": "Data-retention statement published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L13",
      "category": "legal",
      "kind": "probe",
      "title": "Sub-processor disclosure published",
      "requirements": [
        "TS-1.0-10"
      ],
      "status": "mapped"
    },
    {
      "id": "L14",
      "category": "legal",
      "kind": "probe",
      "title": "DPA availability stated",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L15",
      "category": "legal",
      "kind": "probe",
      "title": "Children's data statement present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L16",
      "category": "legal",
      "kind": "probe",
      "title": "Governing-law clause present",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L17",
      "category": "legal",
      "kind": "probe",
      "title": "Breach-notification commitment stated",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L18",
      "category": "legal",
      "kind": "probe",
      "title": "International transfer mechanism stated",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L19",
      "category": "legal",
      "kind": "attest",
      "title": "Record of processing maintained",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "L20",
      "category": "legal",
      "kind": "attest",
      "title": "Data-subject requests answered in 30 days",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S1",
      "category": "security",
      "kind": "probe",
      "title": "security.txt published (RFC 9116)",
      "requirements": [
        "TS-1.0-07"
      ],
      "status": "mapped"
    },
    {
      "id": "S2",
      "category": "security",
      "kind": "probe",
      "title": "TLS valid + HSTS recommended",
      "requirements": [
        "TS-1.0-04",
        "TS-1.0-05"
      ],
      "status": "mapped"
    },
    {
      "id": "S3",
      "category": "security",
      "kind": "attest",
      "title": "Dependency audit run in last 30 days",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S4",
      "category": "security",
      "kind": "attest",
      "title": "No secrets in public repo",
      "requirements": [
        "TS-1.0-08"
      ],
      "status": "mapped"
    },
    {
      "id": "S5",
      "category": "security",
      "kind": "probe",
      "title": "Incident-response contact published",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S6",
      "category": "security",
      "kind": "attest",
      "title": "Backup posture documented",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S7",
      "category": "security",
      "kind": "probe",
      "title": "Vulnerability disclosure program (VDP) published",
      "requirements": [
        "TS-1.0-12"
      ],
      "status": "mapped"
    },
    {
      "id": "S8",
      "category": "security",
      "kind": "attest",
      "title": "Pen test report or attestation",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S9",
      "category": "security",
      "kind": "probe",
      "title": "Bug bounty or equivalent disclosure path",
      "requirements": [
        "TS-1.0-12"
      ],
      "status": "mapped"
    },
    {
      "id": "S10",
      "category": "security",
      "kind": "attest",
      "title": "Encryption-at-rest disclosure",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S11",
      "category": "security",
      "kind": "probe",
      "title": "Content-Security-Policy header set",
      "requirements": [
        "TS-1.0-05"
      ],
      "status": "mapped"
    },
    {
      "id": "S12",
      "category": "security",
      "kind": "probe",
      "title": "Referrer-Policy header set",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S13",
      "category": "security",
      "kind": "probe",
      "title": "Permissions-Policy header set",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S14",
      "category": "security",
      "kind": "probe",
      "title": "X-Content-Type-Options: nosniff",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S15",
      "category": "security",
      "kind": "probe",
      "title": "Clickjacking protection set",
      "requirements": [
        "TS-1.0-05"
      ],
      "status": "mapped"
    },
    {
      "id": "S16",
      "category": "security",
      "kind": "probe",
      "title": "Cookies set with Secure + HttpOnly",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S17",
      "category": "security",
      "kind": "probe",
      "title": ".env not publicly exposed",
      "requirements": [
        "TS-1.0-08"
      ],
      "status": "mapped"
    },
    {
      "id": "S18",
      "category": "security",
      "kind": "probe",
      "title": ".git directory not publicly exposed",
      "requirements": [
        "TS-1.0-08"
      ],
      "status": "mapped"
    },
    {
      "id": "S19",
      "category": "security",
      "kind": "probe",
      "title": "Server version not disclosed",
      "requirements": [],
      "status": "unmapped"
    },
    {
      "id": "S20",
      "category": "security",
      "kind": "probe",
      "title": "CAA record published",
      "requirements": [],
      "status": "unmapped"
    }
  ]
}