Skip to content
Trust • Transparent by default

# Trust is an engineering property.

Evidence-first AI safety: pinned semantics, replayable receipts, fail-closed control.

Report a security issue Download Trust Brief (PDF) Assurance Pack Diligence commitments Open policies
Verify (offline)Proof Responsible disclosure policy security.txt PGP key fingerprint

Prefer email? security@meridianverity.com. No tracking by default.

For business/technical discussion only. Not a compliance certification. Not legal advice. Patent rights are not licensed by publications.
Trust quick facts
Responsible disclosure Private first. Coordinated fixes.
Response targets Acknowledge ≤2 business days. Triage ≤5 business days.
Privacy No analytics, cookies, or third‑party scripts by default.
Contact security@meridianverity.com
Non‑bypassable gate Receipt + log commitment Replay verification

## Trust pillars

Evidence-first signals that survive skeptical review — without relying on trust alone.

Verify Site artifacts

### Verify this site’s verifier

Recompute SHA‑256 + verify DSSE signatures in your browser (same‑origin only).

Open /verify Open /verify-trust Trust Pack Manifest
Verifier signing key `ta.mvg.verifier.signing.2026-02-09.v31.demo` ed25519:sha256:3c78f8fb3ad3ca40…
Snapshot (DSSE)
—

Artifact | Result | Detail
--- | --- | ---

Trust Pack contents

File | Result | Detail
--- | --- | ---

Security intake summary

If crypto is unavailable in this environment, the safe outcome is HOLD.
Assurance Offline‑verifiable

### Assurance Pack

Procurement‑grade assurance artifacts with DSSE + SHA‑256 — designed for skeptical security review.

Open→
Air‑gapped Offline‑complete

### Air‑gapped verifier kit

Run MVG verifiers in an isolated environment (no internet) — with audit‑ready print summaries and ticket‑bound approvals.

Open→
Evidence‑first

### Evidence acceptance criteria

We define what counts as evidence before asking you to trust a claim.

Fail‑closed

### Control points that can’t be bypassed

If required evidence is missing or invalid, the safe outcome is HOLD and side effects remain blocked.

Replayable

### Third‑party replay

Reviewers can reproduce verification steps using deterministic receipts and audit‑ready records.

Hashes Signed

### Artifacts manifest (SHA‑256)

Integrity inventory for reviewers. DSSE‑signed.

Download→
SBOM Proof Playground

### Verifier SBOM

CycloneDX SBOM for the offline verifier assets.

Download→
Release Signed

### Release signature (DSSE)

Binds this site’s artifacts manifest under pinned trust anchors.

Download→
Keys Anchored

### Verifier signing keys

Report signer: `ta.mvg.verifier.signing.2026-02-09.v31.demo`
Fingerprint: `sha256:3c78f8fb3ad3ca4059852ad858a1ee253dbf2a11525f3e649d7dae95a311ec74`

Download→

## Artifacts for review

Start here for security, procurement, or technical diligence.

Open downloads
Assurance Public‑safe

### Assurance Pack (offline‑verifiable)

Executive summary + scope + attestations, with integrity proofs and an offline verifier.

Open→
Sample Public‑safe

### Sample Conformance Pack

Download the exact pack used for the 30‑second offline proof.

Download .zip→
Verify Offline

### Run the verifier (offline)

Buyer‑run verification of pins + receipts. No uploads.

Open /verify→
Policy

### Security Disclosure Policy

Coordinated disclosure, scope, and safe‑harbor terms.

Open policy→
Contact

### security.txt

Canonical contact + disclosure pointers.

Open security.txt→
Brief

### Trust Brief (PDF)

One-page summary for procurement and security review.

Download PDF→
Legal hub

### Legal + procurement policies

Terms, Privacy, DPA, Subprocessors, and cookie disclosures.

Open legal hub→
Research

### Public drafts (optional)

Deep context for reviewers who want primary sources.

Open research→
Note

### Fail‑closed UX

If any link fails, email security@meridianverity.com and we’ll route you. Do not include sensitive personal data.

### Responsible disclosure

Please email security reports to security@meridianverity.com and include: (1) reproduction steps, (2) impact assessment, (3) affected components, and (4) relevant logs (if safe).

We prefer private reporting before public disclosure and coordinate fixes and timelines in good faith.

Do not include sensitive personal data.

### Response targets (best effort)

- Acknowledge: within 2 business days
- Initial triage: within 5 business days
- Coordination: timeline depends on severity + reproducibility

This summary is informational. The policy document governs.

### How we work with reviewers

We align on: (1) the highest‑risk action surface, (2) what evidence is acceptable, and (3) how a reviewer can replay verification.

1. Identify the control point (what must not be bypassed)
2. Define evidence acceptance criteria (what must be proven)
3. Replay verification using deterministic receipts

### Security‑attended deep dive

If you need an expedited, security‑attended evaluation, email us with your control point and threat model assumptions. We’ll propose an evidence plan and a short review path your security team can validate.

Request deep dive Open contact

### Privacy by default

This site ships with no analytics and no third‑party scripts by default. Where we publish policies or artifacts, we keep them reviewable and portable.