Release provenance
A selected repository reference is resolved to the exact commit and retained with the release.
CRA Evidence Pilot
Our evidence model
How release provenance, engineering evidence and accountable decisions remain connected.
A factual operating record
Security tooling produces signals. A release record keeps their context.
Engineering evidence
SBOMs, component inventory and vulnerability observations remain bound to the exact retained snapshot.
Human decisions
Assessments, remediation and verification retain who recorded what and when.
Later proof
Packages, integrity checks and detached signatures provide technical evidence about exact retained bytes.
The result is a factual technical record, not a compliance score and not a legal conclusion.
One product. One real release. Two weeks.
Request a pilot conversation