● PROVEN
“It did this. Here is the witness.”
A finding that ships with a replayable artifact anyone can re-run to the same result. Reproducible: the witness shows that the finding holds, and travels with it.
○TRUST — THE CALIBRATION IS THE BRAND
We would rather return nothing
than return you a guess.
Trust is the whole product, so Protora is sold on a discipline rather than an adjective: every finding carries a replayable witness, the fidelity ceilings are published, and where it cannot prove a thing it abstains — explicitly. Here is that discipline in full: the parts it covers, and the parts it does not.
◐THE DISCIPLINE
Proven, inferred, or abstained. There is no fourth.
Every read Protora returns lands in exactly one of three registers, and it is labeled as such — so you always know which weight a line carries. These are the names Protora uses for the work, the same words everywhere, so a claim always means one thing.
THE RITUAL
DETECT · ATTEST · EXCISE
The guardian’s triad — the product’s spine. DETECT: the Protora Read fires on the weights, and the change is caught. ATTEST: the finding is bound to a replayable Witness and signed. EXCISE: the Corrective Patch pushes the model off its tampered trajectory back onto a safe one.
◐ INFERRED
“The evidence points this way, at this confidence.”
A calibrated inference, labeled as one and carrying its confidence — never dressed up as proof. You see the weight before you lean on it.
○ ABSTAIN
“It can’t be proven, so it won’t be claimed.”
Where a finding can’t be witnessed, Protora declines — explicitly, as a first-class result. The abstain list ships right next to the findings, not buried.
○THE HONESTY
What it will not say — and what still gets through.
The market is filling with confident, unverifiable claims about model internals. Here are the sentences Protora will not print — and the evasions it finds against its own detector and publishes anyway. Owning the misses is the same discipline as owning the evasions.
IT WILL NOT SAYWHAT IT SAYS INSTEAD
“Catches every backdoor” / “complete model understanding”Proof-carrying detection of what it can demonstrate; ceilings published; it abstains on the rest.
“Hardened defense against attackers”Assurance against drift, misconfiguration, and accidental or planted misalignment, with a provenance record.
“Guaranteed clean after excision”Only the removed behavior changed, to the stated coverage; reversible; witness shown.
“Guarantees compliance” / “certifies you”The evidence artifacts the EU AI Act and NIST reward — not legal advice or certification.
A special internal or mathematical edgeThe observable capability and its published ceiling — never the mechanism.
Any number beyond the published ceilingsThe published ceiling for that engine version, stamped.
Overclaiming burns the same trust it is meant to build — so it is a defect, caught in the same review. The compliance framing follows the same rule: evidence, never a certification.
●THE DATA FIREWALL
Your model is infrastructure we are trusted to read — not a corpus we get to keep.
A distinct discipline, and just as hard. Here is what happens to a private model, or a live training run, that you bring us.
- Read, not kept. A private model is operated on in an isolated, tenant-scoped context and dropped when the operation completes. It retains the outputs — findings, witnesses, attestations, any cleaned artifact — not your model.
- Tenant-scoped, end to end. Findings, runs, witnesses, attestations, artifacts, and even the cache are isolated per tenant. A private model’s outputs are private.
- Consent is a separate switch. Turning your model or a training run into engine-training signal takes explicit, revocable consent — never the default, never a hidden term.
- Nothing silent. Every Corrective Patch (excise TRUST-GATED) and every alarm from the in-loop drift guard STAGED is named, versioned, signed, and opt-in per fix or run, written to a tamper-evident, customer-visible trail.
- Delete on request. Full tenant-data deletion is a first-class operation, on request or on churn.
○ IT NEVER
- Uses your private model or training run to improve the engine without explicit, revocable consent — or keeps it past the agreed window.
- Exposes one tenant’s model, findings, witnesses, attestations, or artifacts to another.
- Changes your model invisibly.
- Publishes a backdoor in a public finetune before responsible disclosure.
- Ships a finding it can’t prove, attests beyond its coverage, or overclaims what the guard defends against.
Trust is earned in the open.
Bring one finetune — the one you’re about to ship, or the one you just downloaded. Protora will tell you what it did, prove it with a witness, and tell you plainly what it could not prove.