Every Forge Certified Audit produces a cryptographic artifact that any third party can verify — offline, in any language, without trusting Forge NC at all. This page explains what that means, how we do it, and why it matters for your compliance team, your board, and your customers.
Same protocol behind every paid audit, regardless of tier. The difference between Startup, Enterprise, and Deployment Assessment is what gets audited and how the delivery is packaged — not the cryptographic rigor.
Three paid products. All three use the same underlying Forge Crucible Assurance Protocol (161 scenarios across 16 categories). The difference is what they audit and how the delivery is packaged.
You built an LLM. You want a credentialed third-party certification you can show to buyers, investors, regulators, or insurers. One model, full Parallax dual attestation, Origin-signed, transparency-logged. Choose between forge-hosted (we run it on our RunPod infrastructure) or self-hosted (you run it in your own Forge install so your model weights never leave your network).
Same certification, designed for larger LLM creators with multiple model variants or fine-tunes. Priority turnaround. Same cryptographic guarantees as Startup — Enterprise differs only in scope and SLA, not in rigor.
You are not the LLM creator — you are building a product on top of someone else’s LLM (OpenAI, Anthropic, or an open-source model you fine-tuned or wrapped). You want to know if your specific deployment, with your system prompt, your tool bindings, and your compliance obligations, actually behaves the way you claim. Choose forge-hosted (we hit your public endpoint) or in-VPC (our Docker runner inside your network audits your internal endpoint without ever exposing credentials externally).
For organizations already running AI in production. Automated periodic audits against your live endpoints with alerts when scores drop or certification tiers change. Pairs naturally with a one-time Deployment Assessment as the baseline.
These are the mechanisms that make a Forge Certified Audit different from a PDF any audit firm can email you. Every one of these is implemented in public code you can inspect.
cosign, your existing tooling reads our reports.
Not running a security review? Skip this section. The short version: every report is cryptographically signed and anyone can verify it offline, with no trust in Forge required. The detail below is for teams who want to check exactly how.
crypto_box_seal) for bundle encryption.Every signed report carries an envelope that makes the following cryptographically provable:
order_id, passport_id)target_hash = SHA-512 of endpoint + model)scenario_pack_version, scenario_pack_hash)issued_at, expires_at)Full technical specification with signature payloads, canonical JSON rules, golden test vectors, and verification order: Forge Protocol Specification. Reference implementations in Python and PHP.
| Control | Traditional AI audit firm | Forge Certified Audit |
|---|---|---|
| Report is a signed cryptographic artifact | No (PDF) | Yes (Ed25519 + DSSE) |
| Third party can verify offline without vendor | No | Yes (open protocol) |
| Public transparency log | No | Yes (append-only Merkle tree) |
| Runner source code public | No | Yes (GitHub + Sigstore-signed) |
| Model weights / API key never leave your network | Varies | Yes (self-hosted / in-VPC) |
| Compliance framework mapping (EU AI Act, NIST, ISO 42001) | Yes | Yes |
| Artifact remains verifiable after vendor ceases | No | Planned (perpetuity reserves) |
Every scenario in the 161-scenario Forge Crucible Assurance Protocol is tagged with the regulatory framework controls it exercises:
The mapping is embedded in code at forge/assurance.py — not a marketing claim, it’s a per-scenario attribute that appears in the signed report.
Two paths. Pick the one that matches your trust model:
cryptography), Node.js (built-in crypto), and OpenSSL CLI is published at /verify — the same page hosts both the online verifier and the offline recipes side-by-side. Pull the Origin public key once from /.well-known/forge-origin.json, archive it, and you can verify any Forge-signed report forever without contacting us again.Want to see this in action on a real report? Open the sample audit — both halves of the pair are Origin-certified and ready to verify.
Every Forge Certified Audit report remains verifiable indefinitely, because: (a) verification needs only the Origin public key + an Ed25519 library — no Forge-specific infrastructure; (b) we pin the Origin public key, protocol spec, transparency log archive, and reference verification scripts to a decentralized permanent-storage layer (Arweave). Artifacts from our transparency log survive us.
Yes — two kinds of revocation exist. Pre-publish revocation kills a job’s child key before a report is uploaded (if a bundle leaks or the audit is cancelled mid-flight). Post-publish revocation flags an existing certified report as no longer valid (if fraud is later proven, or the model is materially changed after the audit). Both go through a two-person approval process: an admin requests, Origin approves. Both are recorded in an Origin-signed public revocation feed at /.well-known/forge-revocations.json.
Origin key rotation is announced explicitly at /.well-known/forge-origin.json with cross-signing during the grace window. Rotations are rare by design — the entire point of deriving per-job child keys is that the root key doesn’t need to move.
The 161-scenario protocol and associated tooling are proprietary. The verifier scripts and the open-source runner are published under a source-available license that allows security review and offline verification but restricts commercial redistribution. See the LICENSE file in each repo.
Those firms deliver valuable audit work, but their reports are dashboards or PDFs that require trusting their platform. A Forge Certified Audit artifact is a cryptographic object anyone can verify without our involvement. In the event of a dispute — in front of a regulator, an insurer, or a court — the Forge report is mathematically checkable. Their reports are not.