Trust Centre

Everything a procurement or compliance team needs to evaluate CoverProof in one place — who we rely on, the terms we process your data under, and a candid view of our certification status.

Last updated: 11 June 2026

At a glance

Security controls — tenant isolation, encryption, immutable audit trail.
Model quality & drift monitoring — judge model, sampling rate, alert threshold.
Benchmark suite — versioned regression suite, metrics, named limitations.
What a counterparty sees — zero-login link mechanics, fields shown and never shown.
Privacy policy — controller/processor roles, lawful bases, your rights.
Responsible disclosure — how to report a vulnerability, with safe harbour.
Status — service availability and incident history.
What's new — every customer-visible change, newest first.
Procurement bundle — DDQ-style answers for IT and legal teams: hosting, sub-processors, access control, AI boundaries, certifications.

Methodology, verifier, and evidence links

Methodology and verification

Methodology — Versioned Section 250 classification pipeline, review gates, and evidence-pack methodology appendix.
Methodology changelog — Current methodology versions, fingerprints, promotion status, evidence references, and caveats.
Methodology FAQ — Plain-English methodology, benchmark, verifier, solicitor-review, and claim-gate answers.
Benchmark suite — Regression-suite scope, metrics, limitations, sample-size caveats, and no-certainty caveats.
Coverage data methodology — Sources, provenance, freshness, derivation limits, and claim boundaries for coverage data.

Evidence packs and verifier

Evidence-pack help — What a board evidence pack contains, when it is generated, and what it is not for.
Sample evidence pack — Synthetic PDF/A-3B sample showing the pack format, methodology fingerprints, and no real PII.
Evidence admissibility guide — Business-record framing, court caveats, and solicitor-review boundaries for evidence use.
Model quality and drift — Measured snapshot, drift monitoring, and reviewer escalation context that evidence packs reference.

Sub-processors

These are the third parties that process data to deliver CoverProof. We will update this list before adding a new sub-processor.

Sub-processor	Purpose	Location
Railway	Application hosting and managed PostgreSQL database	United States
Cloudflare R2	Encrypted storage of generated board evidence-pack PDFs	Configurable region
Anthropic	AI classification of SM&CR gap analysis (Claude API)	United States
Resend	Transactional email (magic-links, declaration invites, reminders)	United States
Stripe	Subscription billing and payment processing	United States / UK
PostHog	Consent-gated, IP-anonymised product analytics	European Union

Certifications roadmap — current status, not a claim

We will not display a badge we have not earned. CoverProof holds no third-party security certification today. The following is a forward-looking roadmap, not a statement of current compliance:

Programme	Status
Independent penetration test	Planned — not yet commissioned
SOC 2 Type II	Roadmap — not started
ISO/IEC 27001	Roadmap — not started