Assurance scope: what AttestLayer has and doesn't have

What we have

• Seller: Services AttestLayer, Quebec enterprise number 2282022963, 360 Saint-Jacques Street, Suite G101, Montreal, Quebec H2Y 1P5.
• A named Privacy Officer: Rabie-Abdollah Macbahi, privacy@attestlayer.com.
• Hosting in Google Cloud Montréal, with encryption in transit and at rest and private per-customer package storage.
• Signed packages that anyone can verify online or offline against our published signing keys.
• A public Data Processing Addendum, subprocessor list, retention schedule and vulnerability disclosure policy.

What we don't have yet

• SOC 2 (Type I or II)
• ISO/IEC 27001
• an independent penetration test
• cyber or technology errors-and-omissions insurance
• an external accessibility audit
• transparency-log inclusion for packages (our signing keys are published; log inclusion isn't active)

What we sell

Integrity Check, Buyer Review Essentials, Full Buyer Review Pack, Three-Pack and Five-Pack. See pricing at buy.attestlayer.com.

Record-only boundary

Standard AttestLayer workflows are designed around records the customer is authorized to provide without endpoint installation or production credentials. Package verification can establish integrity and issuer-receipt authenticity; it does not establish the truth or completeness of supplied records, control effectiveness, compliance, certification, legal sufficiency, or customer approval.