Trust and delivery

What you receive from TAKT, how to check it yourself, how to compare it in a controlled test environment before switching, and what happens to your code while we work on it. The Terms of Service, the NDA, the DPA and the Recipients Schedule govern; this page explains them in practice.

What you receive

Every paid build comes as one signed package:

Part	What it is for
`bin/` or `lib/` + `include/`	The optimised build: an executable, or a static or dynamic library with your C headers
`verify/pure.sh`	Observes, on your test runs, network calls, program starts and file writes: it runs the build with no network at all and under `strace`; a check that cannot run here reports INCOMPLETE, not PASS
`verify/diff.sh`	Your original build against the TAKT build on your own inputs: stdout and exit status, byte for byte; ready for your CI
`run/takt-shadow`	Runs your original build, the TAKT build, or both for comparison in a test environment
`SBOM.cdx.json`	The components (CycloneDX 1.5), from your `Cargo.lock`
`REPORT.*`	What was measured and checked before you paid
`escrow/`	When requested and agreed before payment: the order-specific encrypted source escrow box (see below)
`SHA256SUMS`, `SHA256SUMS.sig`	Hashes of every file, signed by TAKT

Check it yourself

ssh-keygen -Y verify -f allowed_signers -I [email protected] -n takt-delivery \
  -s SHA256SUMS.sig < SHA256SUMS && sha256sum -c SHA256SUMS
verify/pure.sh -- bin/YOUR-PROGRAM ARGS...
verify/diff.sh --original 'YOUR-ORIGINAL ARGS' --takt 'bin/YOUR-PROGRAM ARGS' --runs 3

The signing key: /.well-known/takt-delivery-allowed-signers (ED25519, fingerprint SHA256:dVe5e+0WFtQXVcmQYVPLXh9Z3pukqbnNCTWAKEIpKH0). The same line ships in every package.

You may fuzz the build, run sanitizers and any other security tests, including by contractors under confidentiality (NDA, clause 6). For timing, use the open-source takt-harness.

Compare before you switch

Shadow mode in a test environment. run/takt-shadow --mode shadow executes both programs on the same input and logs each run as identical, MISMATCH or TIMEOUT. Use it only with replayable inputs and isolated copies of mutable state: both programs may perform side effects, and the wrapper does not undo them. It returns the original program's captured output and exit status.
Your code stays yours. Your original code keeps working; TAKT_MODE=original runs it again for subsequent invocations.
No time bombs. TAKT adds no licence check, expiry date, remote switch or network call to the delivered build, and continued use needs no ongoing TAKT service. Behaviour already present in your original code is unaffected by this.
Correctness commitment. If, within twelve months after delivery, you report a reproducible difference from your original code on an input within the domain defined by the measurement passport, we deliver a corrected build within 30 days of receiving what we need to reproduce it, or refund the price of that build (Terms, clause 7).
What the checks mean. The scripts report observations for the runs you make: a passing run does not prove behaviour on other inputs or at other times. diff.sh and shadow mode compare stdout and exit status; checks of other outputs, state or effects required by the measurement passport are provided separately.
Start where the stakes are lower. Research pipelines, backtests, parameter sweeps and training are a natural first order; the live path can follow.

Source escrow

Source escrow is available on written request before payment under Terms 8 and the escrow box rider. It is an order-specific bootable image containing encrypted transformed source, its manifest, build environment and the release rule. The Client runs it at its cost on the platform recorded for the order. The image gives source only on the rider's release events; ordinary checks show hashes and results, not the source.

Before confirming an escrow order, the platform and provisioning/handover procedure must qualify. The Schedule records protections and trust model, hashes, PCRs, keys, costs and acceptance. TAKT provisions in an account it controls, binds deployment verification to the receiving channel, then transfers control. The Client removes Provider access and independently verifies the recorded VM and boot over the agreed bound channel before acceptance. An instance label, ordinary SSH connection or local prototype alone does not establish these requirements.

The source must rebuild the delivered binary byte for byte. VM/vTPM loss, replacements, external-source availability and data-disk rollback limits are defined by the rider. The old independent-agent arrangement does not describe new box-model orders. If the required platform qualification is not complete, an escrow order is not confirmed or paid; a Client can choose an ordinary order without escrow or wait for qualification.

Your code while we work on it

Uploaded files are encrypted in your browser before they leave it; nothing is sent if encryption fails.
Your code is built and run only in single-use virtual machines with no network, on our own server in Lithuania; each project has its own key, held in a separate key database.
Project materials are deleted on the date shown in your dashboard (normally 30 days after creation).
Your code is never used for other clients and never sent to an AI provider. Support tickets go to OpenAI only if you allow it for that ticket (Privacy Notice).
The NDA is accepted before upload; hidden inputs stay with you until acceptance.

For procurement

Contracts: Terms, NDA, DPA, Privacy Notice, Recipients Schedule.
Supplier: ABX DEVELOPMENT LLP, registered in Scotland, SO301872, 39/5 Granton Crescent, Edinburgh EH5 1BN, United Kingdom.
Security questionnaire answers, the data-flow description and an SBOM sample: on request to [email protected].
TAKT adds no cryptographic functionality to your build.
Not yet: SOC 2 or ISO 27001 certification.