Authrizd Trust Center
Authrizd is built around the principle that important claims should be traceable to evidence. The Trust Center documents our security approach, data handling, deployment model, evidence practices, control-framework alignment, known limitations, and responsible-disclosure process.
Authrizd uses the existing server-backed application architecture, authenticated product routes, authorization checks in protected APIs, least-privilege configuration, secret handling through environment variables, audit/evidence records, service boundaries, and release/testing controls where implemented. Claims here are limited to repository-visible behavior and deployment configuration.
Public forms collect contact and intake data, assessment requests may include operational context, and optional evidence is processed only for the purposes requested. Routine logs avoid full form bodies. Deletion or export requests should be sent through the security/trust contact path until a dedicated workflow is implemented.
Start read-only. Prove the gap before changing the stack. Authrizd can begin with evidence and APIs from existing systems. Enforcement is added only where supported and appropriate.
Authrizd preserves source attribution, authority evidence, decisions, receipts, replay context, and known limitations where supported by the connected workflow. Hashing, signatures, versioning, and historical integrity are represented only where the underlying evidence path implements them.
GitHub evidence, orchestration, and enforcement boundaries are separated. Authrizd does not claim unsupported native GitHub control coverage; pre-execution checks apply only where the action path supports them.
Authrizd is designed to support mappings to SOC 2 Trust Services Criteria, ISO/IEC 27001, NIST CSF, NIST AI RMF, selected NIST SP 800-53 controls, and relevant OWASP guidance. Framework mappings are not certification and do not represent an independent operating-effectiveness conclusion.
Authrizd records missing evidence, stale evidence, unsupported systems, unobserved actions, uncertainty, and degraded adapters instead of representing incomplete coverage as proof.
Submit security issues through the Security / Trust contact path. Do not include secrets, credentials, or exploit details beyond what is needed to understand the issue.