Status ledger
Verified. Tested.Not yet. Not done.
Every claim, with its evidence.Every capability of Blue Falnoa with the honest state of its evidence. We update this page when the evidence changes, in the same change as the product.
Message usLast reviewed: 10 November 2026
Verified
Run for real, with a real service or program. The evidence is kept.
Authenticator app sign-in
Codes checked against an independent implementation.
Single sign-on
OpenID Connect, with one identity provider. Others are documented, not tested.
Encrypted credentials
Stored secrets encrypted with your key, with rotation.
Tamper-evident audit log
Detects changes in a copy. It is not write-once storage.
Safe start in production
Refuses to start with a missing key or an insecure address, naming the setting.
Locked-down container
No root, read-only, no extra privileges. Scanned with no high or critical findings at the time.
Monitoring export
Traces, metrics and logs received by a real OpenTelemetry collector.
Security log export
Delivered as files. Ingestion by a real security system is not proven.
Connecting an agent platform
One real run completed end to end. Failures and rate limits against the live service are not proven.
Agents over the A2A protocol
Against the official reference agents only, not a live third-party agent.
Deployment on a virtual machine and Kubernetes
In test environments. Nothing has run in a customer environment yet.
Tested
Covered by automated tests that use simulated agents and models.
Roles
Administrator, operator and viewer, enforced on the server, with a test that fails if a route lacks a role.
Passkeys
In a browser with a virtual authenticator. Hardware keys are not proven.
Login protection
Throttling per email and per address, sessions that expire and can be revoked.
Approvals
Written reason, approval rules by amount, risk, role and hour, two-person approval, assisted and manual takeover.
Emergency stop
Suspends every approved agent at once and resumes only those it stopped.
Checking answers and reports
Mark answers correct or incorrect with a reason. Accuracy computed from the checks.
Evaluations
Fixed questions, scheduled runs, regression alerts. Quality with a live model is not proven.
Knowledge
Versioned, published explicitly, searchable. A differently worded paraphrase is not found.
Issues
Problems tracked from an answer or a run until fixed.
Register of AI systems
Owner, purpose, model, data and a risk class chosen by the customer. Not a legal determination.
Personal data detection
Emails, IBANs, tax numbers and card numbers. Names in free text are not found.
Retention, export and erasure
Off until an administrator sets a policy. Nothing is deleted by default.
Cost and budgets per agent
Alert or block at a monthly limit. Costs come from what the agent reports.
Notifications
In-app, email, chat webhook and push. Email and push tested against local stand-ins only.
User provisioning
SCIM request shapes for two identity providers. The conformance run is not clean and no real provider was connected.
Service tokens
Scoped, expiring, revocable. The secret is shown once and stored hashed.
English and Portuguese
Each person picks the language.
Not yet proven
Written or planned, but not run for real, or blocked by something outside our control.
Signed release images
Signing was checked with a local key. The release pipeline has never run.
Real mail and push services
Not run against a real mail provider or a browser vendor’s push service.
Evaluation quality with a live model
The judge ran against the simulated model only.
A live third-party agent
Blocked: no endpoint or token to test against.
Resuming a run that waits in an external platform
Blocked: that platform’s public interface has no resume.
Cloud key services
Not integrated. You provide the key.
Settings in the interface
Some settings are still configuration values. Moving them into the interface is planned.
Not done
It does not exist. We say so.
Certifications
No SOC 2 report, no ISO 27001 or ISO 42001 certificate.
External penetration test
None has been done.
Legal assessment
GDPR and EU AI Act obligations have not been assessed. Dates quoted by anyone need counsel’s confirmation.
Signed data processing agreement
Draft templates exist. Counsel has reviewed none.
High availability
One active instance per customer, with backup and restore.
Customer deployments
No version has been released to a customer environment.
Spot a gap?Tell us.
Send us the hard question.Send us the question your risk team would ask. We will answer in writing and add the row if it is missing.