Trust Center

Evidence before assurance.

Release versions, licenses, security reporting, supply-chain proof and explicit product boundaries in one place.

Release matrix

Component	Current value	Source of truth
npm launcher	`ninfenz@1.1.0`	npm
GitHub Release	`v2.30.0`	Releases
Quality gate	`verify v2.30 · check1-42 · PASS=76`	llms.txt
Official MCP Registry	`io.github.Monyeah777/ninfenz`	Registry

Package and protocol/Release versions are different release dimensions. Verify this matrix before procurement.

Licenses

Community

AGPL-3.0-only for internal use, internal CI, self-hosted platforms and evaluation, subject to AGPL obligations on distribution.

License

Commercial

For closed-source embedding, external SaaS, formal SLAs, security questionnaires, private deployment and enterprise procurement.

Commercial terms

Output exception

Generated documents, reports and intermediate data remain owned by the user, subject to the additional-permission and signed-agreement terms.

Additional permissions

Summary only; not legal advice.

Security and supply chain

Private vulnerability reporting

Do not publish exploit details in an issue. Use GitHub Security Advisories.

Report privately

Release evidence

Releases provide provenance, receipts, checksums, verification cards and a verification report for independent review.

Latest release

Automated controls

SAST, dependency audit, fuzzing, cross-platform checks, SBOM, OpenVEX and OpenSSF Scorecard workflows are in the repository.

Workflows

Data boundary

Core validation and reporting are local-first. Missing verifiers fail closed rather than silently passing.

Security policy

Boundaries

Provided

Deterministic contract execution
Rule IDs and remediation hints
Reproducible reports and hashes
CLI / MCP / Agent / CI integration
Release supply-chain evidence

Not provided

Factual truth or legal advice
General AI observability or drift detection
Real-time prompt firewall
SOC 2 / ISO 27001 certification
Enterprise AI inventory or DLP

Enterprise materials

For security questionnaires, private deployment, SLA, contracts, invoices or OEM integration, contact support@ninfenz.dev. Formal commitments require a signed agreement.