How this measures.

The same requests go to the provider under test and to the real model. We report the difference.

What a provider says about itself does not count as a result.

The same provider answers differently from call to call. A difference counts only when it goes beyond that spread.

Each check has its own threshold.

PROVEN

Proven — two independent checks agree.

STRONG

Strong — one check found a deviation.

SUSPECTED

Possible — the deviation is inside the spread.

INCONCLUSIVE

Not checked — the check could not run. It does not affect the score.

The trust score is a function of the stored findings. The same findings give the same number.

A judge model writes the summary. It never produces the number.

A proven hidden instruction caps the overall score.

So does a mismatch in who is answering. If the replies do not come from the claimed model, the other checks describe a different model, and the score cannot rise above that finding.

• —Whether the provider answers everyone this way. We measure from one place.
• —What it does right now. Every result carries a date.
• —Anything about what was not checked.
• —Intent. We report the numbers only.

The key you paste is used to make the requests, and then it is deleted. It never reaches our database.

• —It is encrypted inside the API process with libsodium, before it is stored anywhere.
• —The ciphertext goes into Redis under an expiry equal to the run timeout. Nothing else holds it.
• —The encryption key exists only in the process environment. A copy of the database decrypts nothing.
• —A fresh nonce each time, so the same key submitted twice looks like two unrelated secrets to anyone reading Redis.
• —The worker deletes it when the run ends — including when the run crashes.
• —Anything key-shaped is stripped from stored requests, responses, logs, evidence and the PDF, by shape rather than by matching your key alone.

how to check it

One script checks all of that against the running system. It greps every text and JSON column in the database, the container logs, every file in artifact storage, and asserts the Redis namespace is empty once runs have finished. It exits with an error if it finds anything key-shaped.

What this does not cover: while a check is running, the worker holds the key in memory. It has to, to make the call. Anyone controlling that machine at that moment can read it.

Against our reference provider you send one key, for the endpoint under test. The reference side runs on ours, so no second key is asked for.

The checks themselves, the requests we send and the thresholds.

Part of every check group is not published at all.