Trust center
The security claim Touchstone makes is checkability, not assertion. Every layer below is signed by an identity you can recover yourself, every artifact that proves it is public, and every number on this page is rendered from the same canonical source the repository's own tests assert against.
Signed layers
Each layer answers one question about a published verdict — who measured it, who put it on chain, who approved the control it applied, and whether the record can be rewritten. Each is verifiable on its own.
A report is signed bytes before it is anything else. The published bundle carries the report, its detached signature, the reporting key id, the policy manifest, the compilation artifacts and the evidence captures the verdict cites.
Proof: verification needs the bundle and nothing else — not this site, not an RPC endpoint, not our continued existence.
Registry v2 accepts a report from any sender, then recovers the publisher from the attached EIP-712 attestation with ecrecover and checks that recovered address against its own authorization list. The relayer (0x5b4e381CA8CCFF91553711512f08B4dF685faFCe) supplies gas; the publisher (0x86A100BDdF8754c95fec97BeC96dBFd64Be44710) supplies authority.
Proof: paying for a publication cannot make you its author. Separating the two is the whole reason v2 exists.
A model proposes controls; it never approves one. Since 2026-08-19 the approval ledger carries the approver's recoverable signature on every decision — the declined ones included, because a refusal is a decision about the same proposal. Each signature binds the proposed candidate's content digest and the compilation artifact it came from, so an approval cannot be moved onto a different proposal after the fact.
Proof: ledger digest b2d8ab788a0ac43b18d0438ba50daf7e3a098003ea0650d8561c0cbb475f5c91 — the value every report commits to and the registry stores on chain as its approval digest.
Signed bytes are never edited. A restatement is published as a correction that names the sequence it corrects and reproduces the original's control-set, evidence and approval roots exactly — the correction tool refuses to sign anything else — and the epoch pointer still resolves to the epoch's first publication, so a correction restates history without opening a new one.
Proof: Corrected is a first-class event beside Published. An indexer that ignores it holds permissive state the record has already withdrawn.
Test evidence
Current run totals belong in CI output, not durable site copy. A green suite says the code passes its tests; it does not say the tests would notice if the code stopped being correct. So the mutation harness removes each shipped fix, one at a time, and requires the tests named for that fix to fail. A surviving mutant is a finding either way — the regression was vacuous, or the fix was never load-bearing — and it is better found here than by a reviewer.
Residual risk
Two residuals matter more than the rest. Both are structural, both are documented in full, and neither is closed today.
Approvals are now signed and attributed, so a decision has an author. What signing does not create is separation of duties: the same person operates the compiler that proposes a control and holds the key that approves it. A well-formed proposal that no human ever intended is stopped only at that boundary.
The reporting and publishing keys are environment variables on their host. There is no HSM, no KMS, no passphrase at rest and no multisig. Host compromise is therefore key compromise, and the operational custody deviation is recorded rather than resolved.
Independent review
4 external judge-perspective review rounds were commissioned during August 2026. Every finding each round raised is carried in the repository under the name its reviewer gave it, with its current disposition beside it — closed, partial, open, or declined on the merits with the reason stated. Nothing is quietly dropped, and a re-reviewer can check their own findings off one by one rather than reading a new roadmap and mapping it back.
That is the accurate claim, and it is the only one made here: findings tracked in public, not a certification. docs/AUDIT-RESPONSE.md in the repository is the tracking document.
Contracts
Every contract, on both chains, with its chain id attached. Several of these addresses exist on both networks as different contracts, so the chain id travels with every row — the full table, with deployment blocks and role addresses, is on the developers page.
Every live contract's source is verified on OKLink (2026-08-20) — and verification is itself a proof: the explorer recompiles the published source and accepts it only when the bytecode and every constructor argument match what is on chain. Mainnet: Registry v2 · Registry v1 · AssetGate · AssetGateV2 · RWAAdmissionController · GuardedAction (permitted) · GuardedAction (refused). Testnet: Registry v2 · Registry v1 · AssetGate (original) · AssetGate (policy) · AssetGateV2 · RWAAdmissionController · GuardedAction (permitted) · GuardedAction (refused). The superseded first testnet registry is deliberately not verified against current sources: it predates the epoch-uniqueness change, and its manifest marks it superseded. The Solidity sources, deployment manifests and runtime bytecode digests also live in the repository.
Read the live registries and gates in the Terminal, then drop a signed bundle into it and watch the checks run in your own browser.