TRUSCOR
Had an AI incident? Get rated
Quiet, never covert

Your system, your data, your report.

We never touch a system without written authorisation, never use leaked data, and never let one client’s findings appear in another’s report.

01The report is private

It belongs to you.

The Financial Risk Report, its score and every finding belong to the client and stay confidential. Anyone can self-assess with SOVA OSS. Only TRUSCOR issues the independent score.

02You decide who sees it

Share it, and revoke it at any time.

Share it with a cyber insurer, a bank, an investor or a buyer, and revoke a verification link at any time. A verification page can confirm a score exists, its date and its scope. It never shows findings.

Your report

The report and score are private.

Who sees your reportYou, and whoever you choose
No public league tableNo public score and no public release of anyone’s vulnerabilities. A company with a bad result fixes it and is retested; nobody else learns of it.
Self-assessment and the independent scoreAnyone can self-assess with SOVA OSS. Only TRUSCOR issues the independent score.
Open format, no lock-inYour evidence stays readable without us. Every Evidence Pack uses the open .sova format.
Neutrality

We measure. We record. We never sell the fix.

Every item in the right-hand column is revenue we give up.

We sell · we never sellThe right-hand column is revenue we give up
The full list
We sellWe never sell
The score and the reportsWe never sell AI agents, applications or frameworks.
RetestingWe never sell remediation of our own findings.
Verification of certificationsWe never sell certifications, until a TRUSCOR standard exists.
SOVA Black Box recording and forensicsWe never sell guardrails, policy enforcement or runtime blocking.
Data on how AI systems failWe never sell insurance cover or carry risk on our balance sheet. We take no commission from anyone we rate or refer.
Our four rules

Four rules.

Four rulesWhat TRUSCOR will not do
The rules in full
No product in any category we rateNo agents, no apps, no guardrails, no remediation.
No referral economicsNo fee, commission or revenue share from any partner, certification body or insurer.
No certification todayWe verify certificates. We do not issue them until a TRUSCOR standard exists with its own governance.
No insurance on our balance sheetA future, separate subsidiary that may manage an AI insurance pool for a fee would be firewalled from rating.
Protecting credibility

The first system we measure is our own.

No score is published without consent, and a rating never requires a TRUSCOR product. Any vendor’s logging or controls count equally if they produce verifiable evidence.

The SOVA stackHighlighted: the parts behind this page
Containment proof O.W.L · .sova

Before O.W.L touches any live-connected system, every run produces a signed containment record: outbound network blocked by default, scoped credentials, and only sandbox state touched.

Available

SOVA Black Box runs inside your own cloud, VPC or on-premises. You control retention and keys.

Available
Public .sova verifiers .sova · SOVA OSS

Independent verifiers in Python and Node check a record offline, without trusting whoever handed it over. They agree on every digest.

Available

Never “no comment”. Reports state their limits (“none observed under stated conditions”), and the method is published and versioned, with a dispute process.

Available
Verifiable scoring TAFAAR · .sova

Judges run inside an attested secure enclave, with hashes of tests and transcripts committed in each .sova file, so the rated party or a regulator can recompute the grade without seeing the secret test items.

Available
Opt-in verification page TRUSCOR Rating

Shows every rating of a system, with dates, not just the best one. Revocable by the rated company.

Available
Being built = the TRUSCOR corpus and its data products, which grow with every consented rating.

Get rated.

Five fields and a short call. We reply within one working day.