A security vendor asking for access to your website should be able to show how it protects itself. Here is how we run, in plain terms, including the parts that are not finished.
A state is shown as verified only while its evidence is recent. When a check has not run lately, the interface says Unknown instead of staying green.
Every capability has a narrow responsibility, an operational state and evidence that explains the result.
Generate a report for a period and it gives a verdict for each Article 21 measure, citing the exact records behind it and carrying a content hash so a reader can tell it has not been altered. A measure with no recent evidence reads Unknown, never as a pass. Three of the ten are organisational and the document says plainly that we do not observe them.
For sites hosted on our infrastructure, an agent beside the scanner reads the web content daily and reports what it found — never the files themselves. A web shell is reported as critical, a packed installer as a nuisance, and a scan that did not finish resolves nothing. Sites hosted elsewhere need an agent on that server.
A card skimmer never touches the server: it arrives as one more script on the checkout page and reads the number out of the form before your own code sees it. So this watches from the only place it exists — the visitor's browser. Paste one snippet into your page; it reports structure and never content, and only on pages that carry a password or payment field. The first report is a silent baseline, because a script you have always loaded is not news.
Passkeys and one-time codes, sessions that live on our server rather than in your browser, and a second check before anything sensitive.
Every deployment records its source, its checksums and the exact command to go back — and the way back is rehearsed.
Separation between customers is enforced by the database itself. Request contents, addresses and personal data are not collected for analysis.
The visitor path remains short. Configuration, verification and rollback stay visible to the operator at every stage.
The security contact and reporting channel are published, not hidden behind a form.
Each capability shows what is available, what is only being watched and what is not built yet.
If a state is green without recent evidence, that is a bug — tell us.
AegiFlow does not turn missing evidence into a reassuring zero. Every state links to its source, freshness and next action.
How this capability behaves in production — grounded in the platform's documented, current operation.
Self-hosted identity with passkeys and step-up verification, opaque server-side sessions, immutable releases with checksums and rehearsed rollbacks, encrypted off-site backups with monthly restore drills, and a public security.txt with a real disclosure channel. The Trust Center shows capability states with the same honesty the dashboard shows customers.
Ownership, certificate, origin health and rollback must pass before traffic protection changes.