Counterfoil console · our lab, real data

Find the weak cryptography, fix it, and check the record yourself.

This console shows a snapshot of 5 test servers we run in our lab, set up with problems real servers often have, then scanned and fixed. The data is real: every number comes from real handshakes, and every fix opens a signed record you can verify in your browser.

Dashboard

Records signed · verify any fixLast scan 2026-09-29

1See what we foundSwitch Before fixes / After fixes at the top to see what changed.

2Open a fixClick any fix to see its signed steps: approve, back up, apply, check, settle.

3Check it yourselfPress Verify. The free checker runs in your browser and says PASS or FAIL.

Servers scanned

20 algorithm settings graded

On hybrid post-quantum key exchange

5 / 5

was 1 before the fixes

Certificates expired

none close to expiry

Limited to TLS 1.2

cannot carry hybrid key exchange

Fixes with a signed record

6 kept, 1 rolled back by the check

Algorithm distribution

Hybrid post-quantum5

X25519MLKEM7685

Resistant5

TLS_AES_256_GCM_SHA3845

Quantum-vulnerable10

RSA-20482

ecdsa-with-SHA2564

EC-prime256v11

RSA-30721

EC-secp384r11

ecdsa-with-SHA3841

Hybrid key exchange

web-rsa✓ X25519MLKEM768

api-ecdsa✓ X25519MLKEM768

portal-expiring✓ X25519MLKEM768

legacy-expired✓ X25519MLKEM768

edge-hybrid✓ X25519MLKEM768

On hybrid means a current client gets hybrid ML-KEM key exchange. Certificates stay RSA and ECDSA: these fixes change how session keys are agreed, not certificate algorithms.

Recent fixes · each one a signed record

Our lab, not a customer: test servers we run, set up with problems real servers often have. Every number was measured from real handshakes by test clients inside the lab network, on the date of the snapshot. The fix records are signed with our key, and the checker shows each one is unaltered and in order. They record what our tools reported. They do not prove a fix suits every client, or that nothing else changed on the host.

Counterfoil

The stub you keep.

Counterfoil is a receipt book for automated work.

A counterfoil is the stub you keep when a ticket or check is issued: your half of the proof. Each step of an automated job is written down, linked to the step before it, and signed. You keep the records. If a record is edited later, the link breaks, and anyone can see it with a free checker that runs on their own machine without contacting us.

WHAT IT PROVES

The record has not changed since it was written, and it was signed with our key.

WHAT IT DOES NOT PROVE

That the work itself was right, or that nothing happened off the record.

CHECK IT ON YOUR OWN MACHINE

The checker is one Python file. Download it with our sample receipt. It needs the internet once, to install one library, and after that it runs with no connection and contacts nobody. It prints PASS, or FAIL with the reason. Change one character in the receipt and run it again to watch it fail. The commands below are for macOS and Linux.

python3 -m venv counterfoil-check
. counterfoil-check/bin/activate
pip install cryptography
python verify_counterfoil.py sample-receipt.json

Download the checker Download the sample receipt Step by step, Windows too

Request an assessment Check a receipt here

Why it matters now

The question has changed from “what did the user do?” to “what did the system do?”

When a person made a change, the log showed what they typed. When an automated system takes fifty steps from one instruction, an auditor asks what the system did, and whether the record of it was touched afterward. That record cannot be written after the fact. You keep it from the start, or you do not have it. Accounting settled this long ago with the ledger. Automated work needs the same thing.

How it works

Four steps, each enforced by the software.

THE FIRST RECORD OF OUR SAMPLE RECEIPT

Step number0

StageSEED

When2026-09-10T16:08:59.572Z

Fingerprint of what happenedb7f6466785…364cac

Points back tonothing: this is the first record

Its own fingerprint521eedc144…8681c9

The record keeps a fingerprint of what happened, not the content itself, and its own fingerprint is computed from every field above.

See a sample of the underlying log on the AI agents page.

What you get

Three things, in order. Here are two real assessments.

An assessment gives you an inventory of your cryptography, a migration plan ranked by exposure, and one evidence file that seals both. Below are two real assessments of open-source projects. Neither project is a customer of ours. One is an SSH library written in Python. The other is over-the-air update software built on Uptane, an update security system for the automotive industry, written mostly in C++. Every row is from the project's source code, and each evidence file verifies in your browser. A row shows where cryptography is used and when it has to move. It is not a defect, and a sample is not an audit of the project or a statement about its security. These two read source code; an assessment for a customer can also measure what their servers negotiate, as the console above does.

paramiko 5.0.0, an open-source SSH library. 41 source files read.

Findings111in 41 files

Must move77by the published rule

Weak classically43DES and MD5 and SHA1; depends on the use

Plan steps13in a safe order

Every use of cryptography our scanner found in the source (41files read), including algorithms the code offers by name, each with its file and line. A scan of source has gaps: it can miss dependencies, compiled code and choices made at runtime. Each finding is ranked by one published rule (Mosca's): if what it protects must stay secret for X = 12 years, and moving off it takes Y = 3 years, then X + Y = 15 years is longer than the Z = 10-year horizon we plan against, so it has to move now. Change those numbers and the ranking changes; they are sealed in the record.

Algorithm	Where	Ranking	Why
3DES	transport.py:263	Weak classically	Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.
3DES	transport.py:182	Weak classically	Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.
MD5	pkey.py:390	Weak classically	Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.
SHA1	config.py:449	Weak classically	Weak without a quantum computer (MD5 and SHA-1 against collisions, 3DES, DES and other 64-bit-block ciphers by their block size, RC4 outright). Whether that matters depends on the use; replace it where the format allows, whatever the horizon.
DH	transport.py:324	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	kex_group16.py:35	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	kex_group16.py:30	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	kex_group14.py:45	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	transport.py:325	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	transport.py:219	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	transport.py:218	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	transport.py:220	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	kex_gex.py:51	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
DH	transport.py:326	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
EC	ecdsakey.py:167	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:113	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	ecdsakey.py:254	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	ecdsakey.py:224	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	ecdsakey.py:268	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	ecdsakey.py:305	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:151	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:67	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	ecdsakey.py:242	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:71	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:145	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:117	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:23	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
EC	kex_ecdh_nist.py:59	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
ECDH	kex_ecdh_nist.py:143	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:327	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	kex_ecdh_nist.py:21	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:329	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:216	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:215	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:328	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	kex_ecdh_nist.py:149	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDH	transport.py:217	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
ECDSA	transport.py:201	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:208	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:313	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:199	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:210	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:315	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:317	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:200	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ECDSA	transport.py:209	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ED25519	transport.py:198	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ED25519	transport.py:207	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ED25519	ed25519key.py:42	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
ED25519	transport.py:319	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	rsakey.py:43	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	rsakey.py:211	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	agent.py:53	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	rsakey.py:210	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	transport.py:791	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:203	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	client.py:431	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	rsakey.py:41	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	transport.py:1317	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	agent.py:54	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:1318	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	rsakey.py:78	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	transport.py:211	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:790	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	client.py:432	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	client.py:433	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:311	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:212	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	rsakey.py:45	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	transport.py:309	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	client.py:434	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	transport.py:202	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	client.py:430	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists. The scanner did not determine how this key is used, so it takes the stricter case: the harvestable case, where recorded traffic is exposed.
RSA	rsakey.py:184	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
RSA	rsakey.py:89	Act now	X plus Y exceeds Z by 5 years. Nothing can be harvested from a signature, but once the capability exists the key can be forged; X is how long the key must still be trusted.
X25519	transport.py:223	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
X25519	kex_curve25519.py:109	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
X25519	kex_curve25519.py:45	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
X25519	kex_curve25519.py:30	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
X25519	transport.py:332	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
X25519	kex_curve25519.py:71	Act now	X plus Y exceeds Z by 5 years. Anything copied today can be read once the capability exists.
AES	transport.py:177	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:251	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:178	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:179	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:227	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:257	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	pkey.py:727	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	pkey.py:691	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:233	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:176	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:239	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	pkey.py:693	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:181	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:245	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
AES	transport.py:180	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:188	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:192	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:287	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	packet.py:47	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:292	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:194	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:191	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:288	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:290	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:293	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:286	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:193	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	hostkeys.py:300	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
HMAC	transport.py:187	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.
SHA256	pkey.py:401	Safe for this horizon	Symmetric key or hash; the known quantum attack (Grover) gives only a square-root speedup. Not a migration target.

How we check our own output

AI states a made-up fact as confidently as a true one.

Invented statute numbers, figures with no source, citations to documents that do not exist: they arrive in the same confident tone as the facts. So we treat every model, including our own, as an untrusted source. Each claim is held to its evidence: numbers, dates, and citations we cannot confirm are removed before anything reaches you. When one of our findings later fails, we correct it in public.

Who it is for

Built for the audit you have not had yet.

US federal contractors

A 2026 executive order sets the end of 2030 for the government's high-value and high-impact systems to use post-quantum key establishment, and orders a proposed procurement rule that would hold covered contractors to the same date. Misstating your cryptographic compliance can bring False Claims Act liability. A scan summary will not answer that question. A record anyone can check will.

Source: Executive Order 14412 (June 2026)

Regulated industries

The EU AI Act requires automatic logging for high-risk AI systems. The 2026 Digital Omnibus moved that deadline to December 2027, but the requirement stands, and a record is far easier to keep from the start than to rebuild later. Counterfoil goes past the requirement: the log is also tamper-evident and checkable by anyone.

Sources: Regulation (EU) 2026/1744 · EU AI Act, Regulation (EU) 2024/1689

Clinical AI and genomics

AI inside regulated medical devices is high-risk under the EU AI Act, with its deadline moved to August 2028. The FDA asks for the same kind of lifecycle evidence in its draft AI guidance. Genomic data raises the bar again: it never expires, so its records must outlast every key that protects it today.

Sources: Regulation (EU) 2026/1744 · FDA draft guidance, January 2025

Anyone deploying AI agents

In a 2026 Grant Thornton survey of nearly 1,000 US senior business leaders, 78 percent were not fully confident they could pass an independent AI governance audit within 90 days. What they lacked was evidence an auditor could check.

Source: Grant Thornton, April 2026

Our summaries of public texts, checked against each source on 30 September 2026. Not legal advice.

Why believe us

Every number here links to its source.

500

IBM Quantum jobs in our account record

See the job ledger

Of our own findings corrected in public

Read the corrections

Internal capability claims backed by a proof that runs

Checked on our machines, not publicly re-runnable. The public subset is on the claims registry

0 of 1

Published receipts an outside party has recomputed and declared. Our own runs never count

Recompute one and declare it

Next step

Two weeks to know where you stand.

It starts with a two-week readiness assessment: what cryptography you run, where the exposure is, and what your auditor will see.

Start the conversation

Counterfoil here is Matrix CR Studio's evidence format. It is not affiliated with other products or companies that use the name.