Collect a record of the work
CI/lock records workflow observations. A report supplied by an agent is a claim until its source and required execution evidence are checked.
The platform for developer and agent trust
Ship with agents.
Keep your standards.
Require build, test, and security evidence before a push is accepted. Give developers and agents the same clear rules—and manage the gates across your repositories in one platform.
Keep your tools. Start with one repository. Inspect every decision.
FROM CHANGE TO DECISIONInteractive example
Update payment retries
CI/lock captures the workYour machine or CI. Your existing tools.
01- BuildPassed · this commit
- Security scanMeets policy · this commit
- TestsNo test evidence
Pushgate checks the pushSigner. Commit. Assigned policy.
02Push refused
Run the required test, capture its result, and try again.
One platform. All your gates.Manage requirements and inspect the evidence across repositories.
Start with your challenge
What do you need
to trust next?
Choose the problem you are solving. See where TestifySec fits and how to get started.
Engineering teams
Bring AI code into your workflow with confidence.
Require evidence that the checks ran before a push reaches your repository.
Protect your next pushPlatform teamsKeep requirements consistent as teams grow.
Manage the gates across your repositories from one place.
Bring your gates togetherSecurity and assurance teamsShow that technical controls actually work.
Connect recovery tests and remediation checks to the controls they support.
Turn tests into evidenceTeams with deployment requirementsRun the platform in your environment.
Explore the software appliance and plan for your data, network, and operating needs.
Explore the applianceThe question that matters
What stops an agent
from fabricating evidence?
The trust comes from the collection boundary and verification—not from an agent saying “the tests passed.”
Read the trust model ↗Choose whose evidence counts
Your policy defines the accepted signing identities, required evidence, and checks. Use a controlled collection environment for evidence that must be independent of the agent.
Verify before accepting the push
The platform checks signatures and the requirements in the selected policy. Required commit bindings connect the decision to the code being pushed.
A valid signature cannot make a false statement true. If an agent controls the trusted collector or can sign fabricated evidence as an accepted producer, signatures alone cannot detect that fabrication.
A simple model for trust
Capture the work.
Check the requirements.
Manage it together.
Start with one repository. As your teams and agents grow, bring their gates and evidence into the same platform.
01 / CI/lockCapture the work.
Capture signed evidence from builds, tests, and scans on your compute or hosted infrastructure.
Explore CI/lock
02 / PushgateCheck the push.
Require evidence before a push enters your repository through the gate.
Explore Pushgate
03 / TestifySec PlatformManage gates. Reuse the evidence.
Manage repository gates and connect technical test results to compliance controls.
Explore the platformBeyond the push
Prove the fix worked.
Show recovery was tested.
A ticket says the work is done. Technical evidence shows what happened. Connect signed test results to the controls your team needs to demonstrate.
Explore technical control evidenceVulnerability remediation
Retain the check that tested the fix.
Recovery rehearsals
Keep a record of the recovery test and result.
Configuration checks
Show what was tested against your requirements.
Open foundations. Enterprise support.
Your evidence should speak an open language.
CI/lock is TestifySec’s enterprise attestation tooling, built on the in-toto™ specification. Capture the work in a format designed for software supply-chain evidence.
Explore CI/lock’s open foundationsin-toto is a trademark of The Linux Foundation.
Open-source adoption
Inside Autodesk’s evidence workflow.
See how Autodesk uses Witness and Archivista to work with software supply-chain evidence.
Read the Autodesk storyBefore you begin
Find your starting point.
How is Pushgate different from the platform?
Pushgate is the checkpoint for a Git push. The platform manages multiple repository gates, their requirements, and the evidence behind their decisions. It also connects technical test results to compliance controls.
Do we have to replace our CI tools?
Keep the builds, tests, and scans you need. CI/lock records their execution; Pushgate and the platform use that evidence to evaluate your requirements.
Can we run the platform ourselves?
The software appliance packages the platform for your own environment. Explore the appliance and plan an evaluation.
Your next step
Start where you are.
Build on trust.
Explore the platform with your team,
or try Pushgate on your next repository.