What you receive
- The assessment: every question, its outcome, and the evidence it was decided from.
- The evidence documents themselves, whole, as they were collected.
- Coverage: what was read, what was not, and what that leaves unestablished.
- Findings with their basis, whether Microsoft requires it, documents a limit, recommends it, or whether it is a convention or an opinion, and what each one does not establish.
- Instructions to verify all of it without us.
They are yours, and reading them never needs us
The artefacts are files, in your storage, permanently. Anyone you send them to can check that nothing moved, using software that is open source and free forever. Verification does not need a licence, an account, or pH7x Systems. That is not a courtesy; it is the property the whole method rests on, and it is why the assessment is worth showing to somebody who does not trust you yet.
You could run it yourself
The engine is MIT-licensed and public. What you are paying for is our time to run it and to read the result honestly, the interpretation, not permission. If you would rather do it in-house, the documentation is there and nothing here is withheld. The engine is here, and itsdocumentation is public.
How you know it worked
- Verification passes on your machine, without us.
- Every finding traces to the evidence it was decided from.
- Coverage names what was not read.
Read a specimen assessment, in full, before you buy anything.
Tell us which tenant, and what you are trying to be able to show.