Skip to main content

How each claim is checked

Don’t take our word for it.
Reproduce it.

Nervos sells governance, so our claims must survive your scrutiny. Each claim below can be checked against this build’s endpoints, your own browser’s crypto, or the source, and each says where it stops.

Identifiers such as SOD-01 refer to the claims register, which gives every claim’s status in each environment and is described on the trust page. Pilots include a sandbox tenant so your security team can run the full replay script, not a demo.

Verify a ledger in your browserRequest a sandbox tenant

Claims

Six claims, each with how to check it and what you should see.

Public checks need no account. Tenant-token checks need a signed-in user on a Nervos tenant.

  1. The audit ledger is hash-chained and tamper-evident

    Access: Tenant token

    How to verify
    GET /api/actions/proposals/[id]/ledger

    Export any execution ledger, then recompute each SHA-256 entry hash from the canonical step JSON — or paste the export into /ledger-verify and let your own browser do it via Web Crypto.

    What you’ll see
    Every recomputed hash matches its entry_hash and each entry links the previous one. Alter any field without recomputing the hashes after it and the chain breaks at that exact row. A chain whose last steps were removed still verifies: compare its length and last hash with an earlier export.

  2. Tenants are isolated at the database layer (RLS)

    Access: Tenant token

    How to verify

    Authenticate as org A and request a proposal ID belonging to org B. Row-Level Security policies (org_id = current_org_id()) are enforced by Postgres, not application code.

    What you’ll see
    “Not found” / 401 — never another org’s data. Forged org_id inserts are rejected by policy.

  3. The write-gate is server-side and locked

    Access: Tenant token

    How to verify

    POST an action type that is not in the locked registry (lib/actions.ts) to the execute endpoint. Agents and users can only propose registry-defined actions with defined risk levels.

    What you’ll see
    The request is rejected server-side. There is no code path for an arbitrary write.

  4. Executed actions are idempotent and reversible

    Access: Tenant token

    How to verify

    Execute an approved proposal twice: the second call is refused while the first is in flight, or answered from the first once it has executed. Against a NetSuite RESTlet older than 2.2.0, a retried attempt may still write twice, and the ledger records that doubt (IDEMP-01). Then roll it back: reversible actions map to a compensating write (e.g. createVendorBill ↦ voidTransaction).

    What you’ll see
    The second execute of an executed proposal returns { idempotent: true } with the first result. The rollback lands in the same hash-chained ledger as a compensation step.

  5. Security headers are enforced, not report-only

    Access: Public

    How to verify
    curl -I https://www.thenervos.com

    Read the response headers — no account needed.

    What you’ll see
    Content-Security-Policy (enforced), Strict-Transport-Security with preload, and the rest of the hardening set, on every response.

  6. The proposer on record cannot approve their own action

    Access: Tenant token

    How to verify

    Create a proposal, then attempt to approve it as the same user (web or Slack). The approval route and a database trigger refuse it, and the attempt is counted as a governance metric. Until a pending migration is applied, a proposal inserted directly through the database API can name someone else as its proposer (SOD-01).

    What you’ll see
    The approval is blocked with a self_approval reason and appears in the governance summary as a blocked attempt.

What we don’t claim

Verification is the point, not credentials.

Honesty is part of the product. Nervos holds no SOC 2, ISO 27001, CMMC or FedRAMP report, certification or authorization, and no auditor has been engaged; you will never see one presented as a credential here. The NIST 800-171 and SOC 2 control mappings are available under NDA, stated exactly as far as the evidence goes.

Next

Recompute a ledger’s hash chain in your own browser.

The ledger verifier is public and needs no account: paste an exported ledger and your browser recomputes every entry hash with Web Crypto.

Verify a ledger in your browserTalk to us