Trust posture, plainly stated.

What we have today, what we are working on, and what we have not yet earned the right to claim. Every line on this page is meant to be defensible to an auditor.

Current capabilities

  • Deterministic AVC validation with structured reason codes.
  • ML-DSA-65 (CRYSTALS-Dilithium) signatures and hybrid mode.
  • Hash-chained trust receipts.
  • Zero-priced launch settlement with explicit ZeroFeeReason.
  • Constitutional governance kernel on governance paths.
  • Twenty CI quality gates plus aggregator on the reference implementation.

Roadmap

Earned, not yet claimed

  • Independent third-party security audit.
  • SOC 2 Type I readiness statement.
  • Public bug bounty.
  • Validator hardware attestation v2.
  • Mainnet membership rules.
  • NIST AI RMF and emerging AI policy framework mappings.

Three surfaces, three trust postures

EXOCHAIN's web presence is split across three surfaces with hard separation. Each surface enforces its own auth and capability rules at the route boundary.

  • SURFACE Internet: public exochain.io docs · trust center · status press · research · contact
  • SURFACE Extranet: authenticated · OIDC app.exochain.io AVC issuance · validation · receipts audit exports · API keys
  • SURFACE Intranet: internal · SSO · MFA · step-up internal.exochain.io governance · pricing policy · incidents security queue · content · logs

Cryptographic assumptions

Statements here reflect implemented primitives at the time of writing. EXOCHAIN treats post-quantum readiness as a baseline and tracks evolving guidance. See /docs/security.

Responsible disclosure

Coordinated disclosure intake is at /security. Provide reproduction steps and an intended public disclosure date; we will respond with an acknowledgement window and assigned severity.

Privacy and data custody

AVC payloads are minimized by default. Consent records carry only a scope hash, not the underlying data. PII is not required to register an actor. Aggregate metrics shared with researchers are anonymized.

Zero-priced launch settlement

The transaction mechanism is live. Every active price resolves to 0 EXO with an explicit ZeroFeeReason. Future governance amendments may enable nonzero pricing.

EXOCHAIN is in alpha. Nothing on this page should be read as a claim of completed third-party audit or regulatory approval unless a linked artifact says otherwise.