Everything a vendor review asks for.
On one page, so you do not have to ask us for it one document at a time.
The company
| Legal entity | Falsify OÜ, registry code 17574308, Estonia |
| Independently verifiable at | ariregister.rik.ee |
| Registered office | Narva mnt 5, 10117 Tallinn |
| Full details and continuity | /legal |
The documents
| Privacy and data handling | /privacy |
| Subprocessors | /subprocessors |
| Terms | /terms |
| Security policy and reporting | /security |
| Data processing agreement | On request, before any engagement starts |
| Pricing and scope | /pricing, fixed price by scope, no bands |
| What a deliverable looks like | a worked Evidence Pack, with real hashes you can check |
Current assurance posture
| SOC 2 / ISO 27001 | Not held. Security practices are documented on the security page; the deliverable itself verifies offline and does not depend on our infrastructure. |
| SSO / SAML | Not offered. The registry requires no accounts; there is nothing to sign into. |
| SLA | No formal SLA. Verification is offline against artefacts you hold, so registry availability does not gate your evidence. |
| Penetration test | No third-party report held. An independent review of the commitment primitive is being scoped. |
If one of these is a hard requirement for your review, this page is intended to answer that early.
Two things that reduce your risk more than a badge would
- The deliverable does not depend on us. Receipts carry third-party RFC 3161 timestamps and public Rekor entries, and verification is offline. If this company stops, what you already hold still verifies. See the continuity answer.
- Everything is inspectable before you buy. The specification, the four implementations, the conformance suite, the registry and a worked deliverable with real hashes are all public. You can form a technical judgement without a sales call and without signing anything.
Anything missing from this page, write to [email protected] and we will add it here rather than send it to you privately.
If you are writing the requirement rather than answering it, the clause and the gate it belongs to are set out on the require page, along with the four bodies that already ask for criteria to be fixed before results are known.