Answers about verifying that claims about delivery, credentials, liveness, and configuration actually have evidence at the right layer.
It checks whether claims about delivery, credentials, liveness, configuration, or external receipts have fresh evidence at the right layer. Think of it as a lint for “trust me” statements—it asks for proof at the layer the claim describes.
Instead of accepting “the system is secure,” it asks: what evidence exists that the control is actually operating? A green dashboard is not evidence. A signed attestation is not evidence at the infrastructure layer. The verifier flags the gap.
Five claim categories map to five evidence layers:
Delivery claims — “the API is live” → needs a live response, not a status page screenshot.
Credential claims — “we have SOC 2” → needs the actual report, not a logo on a website.
Liveness claims — “the service is healthy” → needs a health endpoint response, not a dashboard.
Config claims — “TLS is enforced” → needs an active TLS handshake check, not a policy document.
External-receipt claims — “we got confirmation from the vendor” → needs the actual receipt or message, not a verbal relay.
A dashboard green light does not prove the underlying system is healthy. A certificate PDF does not prove the control is operating. A policy document does not prove a configuration is enforced.
The verifier checks that evidence exists at the right layer—not just that someone said it is fine. This matters because claims cascade: if the evidence layer is wrong, every downstream claim that depends on it is also unverified.
No. It is a structured checklist for evidence verification. It does not probe ports, scan for vulnerabilities, or attempt exploitation.
It lints a claims manifest against expected evidence types and flags gaps. Think of it as the difference between checking that a fire extinguisher exists (scanner) and checking that it was inspected last month and the tag is current (verifier).
Yes. Create a claims manifest for what the vendor asserts, then check whether evidence exists for each claim. The output is a portable JSON receipt with a digest of what was checked.
The receipt is portable: you can share it with auditors, customers, or your own compliance team without re-running the verification.