Trust Artifacts

Verifiable Audit Evidence

Trust Artifacts are cryptographically hashed, machine-verifiable attestations that record your AI security scan results with tamper-evident SHA-256 digests. Embed them in READMEs, share with auditors, or verify programmatically via API.

Note: Trust Artifacts are a legacy/specialized artifact system. For the current HAIEC Assurance model, see U6 Assurance Packages with ALLOW/REVIEW/BLOCK dispositions.

Validate My AI View an Audit-Ready Report

Example Trust Artifact Badge Format

HAIEC

|SOC2 Evidence Ready

Click to verifyCryptographically hashedMachine-readable JSON

Try It On Your Repo

Install the GitHub App on your own repository, open a PR, and see your first artifact.

View Example Repo Install on Your Repo

3 steps: Install on your repo → Open PR → View artifact comment

What Are Trust Artifacts?

Unlike traditional compliance certificates, Trust Artifacts are tamper-evident records of the scan results and scope represented by the legacy artifact—generated automatically from real scans.

Deterministic Evidence

Generated from scanner output and compliance checks. Deterministic, traceable results from the same inputs - designed for technical, executive, and assurance review.

Cryptographically Hashed

Each artifact includes a SHA-256 evidence hash. Tamper-evident and independently verifiable by anyone.

Machine-Readable

Full JSON payload available via API. Integrate into CI/CD pipelines, auditor workflows, or procurement checks.

What's Inside an Artifact

Each artifact contains structured, verifiable data about your scan results and evaluated scope

Field

Description

artifact_id

Unique identifier (e.g., SOC2-abc12345)

type

AI_SECURITY_ATTESTATION or COMPLIANCE_EVIDENCE_MARK

status

LEGACY: SECURED, EVIDENCE_READY, EVIDENCE_PARTIAL (S0 trust containment - not U6 Assurance states)

evidence_hash

SHA-256 hash of all scan evidence

issued_at

ISO 8601 timestamp of generation

expires_at

Validity period (typically 1 year)

scope

What was verified vs not verified

risk_posture

Critical, high, medium, low issue counts

Embed in Your README

Add a verifiable trust badge to your repository in seconds

Markdown

[![HAIEC Trust Artifact](https://www.haiec.com/api/badge/YOUR-ARTIFACT-ID)](https://www.haiec.com/artifact/YOUR-ARTIFACT-ID)

HTML

<a href="https://www.haiec.com/artifact/YOUR-ID"><img src="https://www.haiec.com/api/badge/YOUR-ID" alt="HAIEC Trust Artifact"></a>

API Verification

curl https://www.haiec.com/api/v1/artifacts/YOUR-ID.json

How It Works

Install GitHub App

Connect HAIEC to your repositories via GitHub Marketplace

Automatic Scanning

We scan on every PR for security signals using deterministic rules

Artifact Generated

Passing scans generate cryptographically hashed trust artifacts

Embed & Share

Add badges to READMEs, share with auditors, verify programmatically

Use Cases

Open Source Projects

Show contributors and users that your project follows security best practices with a verifiable badge.

Enterprise Procurement

Provide instant, verifiable evidence of scan results to procurement teams evaluating your software.

Auditor Handoff

Share machine-readable evidence with auditors. No more manual evidence collection.

Generate Your First Audit Evidence

Run a security validation scan and generate verifiable, tamper-evident compliance evidence. Start with a free self-audit.

Validate My AI View an Audit-Ready Report