> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security governance and assurance

> Current technical evidence, policy status, shared responsibilities and enterprise review materials.

Revision: 15 October 2026.

Truthlocks maintains technical specifications, security policies, a risk register and an evidence inventory. The policy set was rewritten for the Google Cloud platform on this date. Management approval and operating evidence are tracked separately; a document's existence does not establish that its procedures have been performed.

## Materials for your review

| Material | Purpose |
| - | - |
| [Platform architecture](/enterprise/architecture) | Services, information flows and responsibility boundaries |
| [Signing specification](/enterprise/signing-algorithms) | Supported algorithms, managed keys and known historical-key limits |
| [Information handling](/enterprise/information-handling) | Private vault access, versions, retention and disposal |
| [Enterprise setup](/enterprise/setup) | Organization identity, environments, SSO and acceptance checks |
| [Versioned governance documents](https://github.com/truthlocks/truthlock/tree/main/docs/compliance/soc2) | Proposed security, access, change, monitoring, incident, privacy and supplier procedures |
| [Governance working records](https://github.com/truthlocks/truthlock/tree/main/docs/compliance/isms) | Draft risks, applicability review, evidence index and approval templates |

Read each document's status and revision. Completed approvals, staff records, contracts, identity evidence and confidential assurance reports belong in a restricted evidence store; they are not published in this library.

## What technical evidence establishes

A test report describes its exact scenario, version and result. An isolated database test can establish a transaction's behavior under that fixture. A hosted sandbox check establishes the exercised sandbox path. Neither proves that every production workflow, vendor integration or governance activity has passed. Mocked staff pages are labelled as UI checks rather than real privileged operations.

Published evidence includes tenant-scoped usage records, duplicate-mint protection, sandbox charging exclusions, signed-record verification and reviewed invoice workflows. Automatic provider collection and merchant lifecycle acceptance remain separate from recording an invoice payment already received.

## Assurance status and requests

This page does not claim SOC 2 examination completion or ISO/IEC 27001 certification. Readiness requires approved responsibilities and procedures, risk and applicability decisions, actual access and supplier reviews, training, recovery exercises, incident readiness, internal audit and corrective action evidence. Independent assessors determine whether the relevant examination or certification requirements are met.

Contact [security@truthlocks.com](mailto:security@truthlocks.com) for a current assurance review. Agree the information scope, authorized recipients and confidentiality arrangements before sharing private evidence. Contractual region, retention, recovery and service-level commitments require approved terms; do not infer them from a technical example.

The programme uses the [AICPA SOC resources](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) and [ISO/IEC 27001](https://www.iso.org/standard/27001) as references. Its operational mappings do not replace the complete applicable criteria or licensed standard.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.