no — deterministic offline scan; enrich uses your own key; telemetry opt-in
Not for scanning. The analyzer is read-only and reports findings without changing your files. If you use trustabl enrich, it proposes a patch for review and only applies it when you choose --apply; it also creates a .trustabl.bak backup and skips stale fixes when the file has changed since the scan.
Trustabl is built for AI engineers, platform teams, and security/compliance teams who are building or running agentic systems in production and want tools that are reliable, observable, and policy-compliant.
The open-source analyzer can surface findings that are useful inputs to compliance work, but it does not certify SOC 2, GDPR, PCI, or other compliance on its own. Trustabl Console is the planned commercial layer for compliance mapping and signed governance snapshots.
