Most trust pages are a list of promises and a badge. You read them, you nod, and you take the company's word for it, because that is all the page offers.
A company that sells verification cannot ask for that.
So our trust page at apir.ai/trust works differently. Every line carries one of three marks.
Checkable
It links to something you can verify without trusting us. The public keys every passport verifies against. An agent's papers with its log book recomputed. A seal with its outside timestamp, which openssl checks against the authority's certificate. The offline checker that makes no network request. TLS on apir.ai, which anyone can test from a terminal.
Our word
A statement about our own systems. Row-level security on every table. Signing keys that never leave the vault. No secret in the browser. A person approves anything an agent drafts before it is sent. These are true and dated, but they are ours, and the page says so rather than dressing them up.
Not held
A certificate or test we do not have, in those words. We hold no SOC 2. We hold no ISO 27001 or 42001. No third party has run a penetration test on us yet. Our hosting and database providers hold their own reports. Those are theirs, not ours.
A small company should say that plainly. When an audit is engaged, the page will name the auditor and the date. Until then, the rest of it is built so you need neither.
Read it with the same suspicion you would bring to anyone else's. That is the point.