Review the boundary.
Inspect the evidence.
One page, because the alternative was four and two of them unlinked. It includes what we do not hold — a trust page listing only the good news is a marketing page with a padlock on it.
Review the assurance boundary
Look at the contract and the evidence.
Move between the record, the declared scope and the remaining qualification work.
Select an illustrated object to inspect its role.
01 / 03
Open the evidence behind the statement.
Check the source, version, environment and limitation before using a figure in an assessment.
Source-linked published recordsInternal or local synthetic checks do not establish independent reproduction or customer validation.
Start with the boundary, not the badge.
See where data runs, who owns the workflow and which claims are deliberately out of scope.
Customer infrastructure, keys and operating ownership are part of the review.Follow each claim to its record.
Published material links the statement to the run, verifier or design boundary that supports it.
Measured means measured in a bounded run; it does not mean production-ready.Make the gaps visible before procurement.
Open items stay visible so a buyer can turn them into acceptance criteria instead of discovering them after deployment.
A useful trust centre says what is not held as clearly as what is.Fresh deployment evidence
AWS target-representative run: PASS. 117,290 verifications, 0 performance errors, 19.47 ms p95, AWS KMS-backed signing and 51.5 second controlled recovery with 0 lost acknowledgements.
Read the figures with the hardware. Measured on t3.small compute and db.t4g.micro database, single-AZ. Both are burstable classes: a percentile measured while CPU credits are draining describes a transient rather than the service, so these numbers should not be extrapolated to sustained production load. We publish them because they are what was measured, not because they are a capacity claim.
This closes the target-environment measurement gap; it does not claim production customer validation, certification or a Well-Architected review. See the full measurement record → Download the standalone verifier →
Published and checkable
Controls, architecture and the security pack as JSON and Markdown.
Open →WCAG 2.1 AA contrast measured across the site, including the 34 failures found and corrected. Screen-reader testing is declared as not done.
Open →Seven, read off what the code calls. The Assurance Runtime itself has none: it runs in your account.
Open →Health evaluated on page load. No uptime history, because nothing records it yet.
Open →What we will and will not assert.
Open →Every claim with its verification method, including results we have withdrawn.
Open →An engineering outline, not legally reviewed, published rather than gated behind a request. Two clauses named as unresolved before it is legally reviewed.
Open →No SLOs are published, because none has been measured. What will be measured, and the sequence that has to happen first.
Open →What a termination request deletes outright, what it cryptographically erases instead, and what EcoKure never held in the first place.
Open →What an independent tester would attack, ranked by damage. No test has been performed; the scope is written so commissioning one is a purchasing decision, not a scoping project.
Open →What we do not hold
Listed with the same prominence as everything else. If any of these is a hard requirement for you, you should find out now rather than at contract stage.
Why this page exists in this shape. We audited the site as ten different evaluators. The vendor security assessor — the gate every enterprise deal passes through — was the worst served: seven questions, no single page covering more than three, four pages to visit and two of them not in the navigation. That is an expensive failure precisely because it stays invisible until a deal stalls.