Trust surfaces, rendered from the system itself
Nothing on this page is written by marketing; trust asked for should be trust shown. Each data section below is a build artifact of the same machinery that runs the service: regenerated nightly, hash-addressed, and reproducible with the open tools.
The public attestation log
No attestations have been published yet. This section renders the live hash-chained log the moment the first audit concludes; nothing here is ever an example row.
Proof of life
Verified-consumption counts appear here once serving telemetry exists. When the numbers are small, this page will say so; that is the point of it.
A promise is cheap to type, so this page holds as little prose as it can. What follows is generated from the ledgers, logs, and attestation records of the running system, and every claim on it can be reproduced offline with the open toolchain.
What you pay, and when: the published rules
- Monitoring, the standing service, is a flat monthly plan with
an included allowance; every statement is canonical JSON with its own content hash, sigstore-signable, reproducible from the ledger.
- The audit is optional: a one-off, invoiced on delivery. It is
never usage-metered and never touches a consumption ledger.
- **The connector serving tier is free until engines demonstrably
consume your bundle.** Thresholds are published in the activation policy (v2), never applied retroactively, with monthly signed consumption receipts you can audit.
- Leaving is one command.
okf-hosted tenant exporthands you the
complete bundle; the open CLI serves it unchanged. Free egress is a tested acceptance criterion, not a promise.
What we hold, and for how long
- Bundles hold catalog knowledge, not shopper data. Prices and
stock are never static claims anywhere in a bundle.
- Order records: buyer email (used to deliver the report, nothing
else), amount, order metadata. Card data exists only at the payment processor.
- Serving logs: processed to monthly aggregates; **raw logs are
deleted within 30 days**; no IP address is ever persisted in an aggregate. Platform privacy requests (data request / redact) are answered from this inventory and recorded.
Verify this site
This site is an OKF bundle. Its manifest hashes every file; its copy concepts carry named attesters. Reproduce our claims rather than taking them:
- page copy is human-attested:
okf-web lint <bundle-url> --strict - attestation chain intact:
okf-hosted attestations verify - sample report unmodified:
sha256sum geo-report.html - coverage numbers reproducible:
okf-web evaluate <bundle> --dry-run