Skip to main content
Revision: 15 October 2026. Truthlocks maintains technical specifications, security policies, a risk register and an evidence inventory. The policy set was rewritten for the Google Cloud platform on this date. Management approval and operating evidence are tracked separately; a document’s existence does not establish that its procedures have been performed.

​
Materials for your review

Read each document’s status and revision. Completed approvals, staff records, contracts, identity evidence and confidential assurance reports belong in a restricted evidence store; they are not published in this library.

​
What technical evidence establishes

A test report describes its exact scenario, version and result. An isolated database test can establish a transaction’s behavior under that fixture. A hosted sandbox check establishes the exercised sandbox path. Neither proves that every production workflow, vendor integration or governance activity has passed. Mocked staff pages are labelled as UI checks rather than real privileged operations. Published evidence includes tenant-scoped usage records, duplicate-mint protection, sandbox charging exclusions, signed-record verification and reviewed invoice workflows. Automatic provider collection and merchant lifecycle acceptance remain separate from recording an invoice payment already received.

​
Assurance status and requests

This page does not claim SOC 2 examination completion or ISO/IEC 27001 certification. Readiness requires approved responsibilities and procedures, risk and applicability decisions, actual access and supplier reviews, training, recovery exercises, incident readiness, internal audit and corrective action evidence. Independent assessors determine whether the relevant examination or certification requirements are met. Contact security@truthlocks.com for a current assurance review. Agree the information scope, authorized recipients and confidentiality arrangements before sharing private evidence. Contractual region, retention, recovery and service-level commitments require approved terms; do not infer them from a technical example. The programme uses the AICPA SOC resources and ISO/IEC 27001 as references. Its operational mappings do not replace the complete applicable criteria or licensed standard.