00TraceAxiom / public trust record
Trust should be a record, not a badge.
Identity, product status, data handling, security boundaries, and evidence authority, published together so an open limitation cannot hide behind a polished claim.
01Identity
Arhan Canli operates TraceAxiom and publishes its current legal status.
TraceAxiom is an independent product project founded in 2026 and operated by Arhan Canli, founder and lead engineer. The About page links Arhan's public engineering profile as the canonical external identity record.
Legal status: pre-incorporation. When formation is complete, the legal name, policies, contracts, and structured data will be updated together. Until then, agreements identify Arhan as the operator.
- Named founder and operator
- Public engineering profile
- Pre-incorporation status disclosed
- No implied customer or corporate identity
02Product status
Verify is in development and not installable yet.
TraceAxiom's product is Verify, a GitHub Action. It posts its verdict as a comment on real pull requests in TraceAxiom's own repository, since 3 October 2026. Built: tests on base and head, control tests, the separate user, three claim checks, mutation testing of the changed lines, and the verdict comment. Not built yet: signed receipts end to end, independent tests written by AI, and the install flow.
The public site labels illustrative material as illustrative. It publishes no usage, accuracy or speed figures, and it will not until real runs on other people's code exist.
- Illustrative runs remain labelled
- Built and not-built parts listed separately
- No figures before real runs
- Not installable yet
03Data
The public site collects only what its access workflow needs.
The site has no advertising pixels or behavioral analytics scripts. A design-partner request contains the fields a visitor submits, plus a salted hash of the request IP address and a bounded user-agent string for abuse prevention. The public privacy notice names each current service provider and the purpose it serves.
Customer code is not collected through the public access form. Visitors should not place credentials, secrets, regulated data, or confidential source code in a request. A private data boundary must be agreed before any design-partner material is handled.
- Vercel hosts the site and intake function
- Supabase stores access requests
- Resend delivers request email
- No advertising or behavior tracking
04Security
Security claims stop where independent authority stops.
The Security page publishes the vulnerability-reporting policy, and a machine-readable security.txt file points researchers to it. Reports are acknowledged privately and are never treated as resolved merely because a tool says they are.
TraceAxiom has not completed an independent external security assessment and holds no security certification. Verify is a GitHub Action, so it will run on the CI runners of the repository that installs it; its permissions will be documented before it can be installed.
- Public vulnerability-reporting route
- No credentials in reports
- Independent review remains open
- Permissions documented before install
05Evidence
Every material product claim should have a path back to proof.
Product statements on this site follow TraceAxiom's internal status record: what is built is called built, and what is planned is called not built yet. The website's own release record publishes what its release gate checked, the exact source it checked, and where that check stops.
This trust center is a map to those boundaries, not a certification badge. It does not replace customer due diligence, contractual commitments, a penetration test, or an independent audit. Those forms of authority will be named only when they actually exist.
- Built and planned stated separately
- Website release record is public
- Limitations travel with results
- No synthetic evidence presented as live
Questions and reports
Ask about the boundary you need to verify.
Product, privacy, security, and evidence questions use one public contact record. Do not send credentials, source code, or sensitive vulnerability details in the first message.
Open contact record