Radical honesty
What CAIN Trust Fabric does not do yet
The gaps, itemised, from the team that would have to fix them.
Last reviewed 31 August 2026
This page exists because we are new, and because the fastest way for a new platform to lose an experienced evaluator is to be caught rounding up. Everything below is a real gap. None of it is on a marketing page anywhere else on this site, so here it is in one place.
If one of these is a hard requirement for you, we would rather you find out now than three weeks into an evaluation. Several are on the roadmap; the ones that are not, are not.
SOC 2, ISO 27001, or any third-party certification
We have mapped our controls to SOC 2 and ISO 27001 criteria and published that mapping, which is a readiness exercise and nothing more. No auditor has examined this platform. If a certification is a hard procurement gate for you, we do not meet it today.
Independent penetration test
The security work here is our own, plus an internal red-team suite. No external firm has tested it. We publish a threat model and a disclosure policy so the gap is at least visible and reportable.
Multi-region or multi-provider redundancy
The hosted deployment runs multiple gateway replicas behind one ingress on one provider. That covers process failure, not site failure. There is no disaster-recovery region and no documented RTO/RPO commitment. The self-hosted deployment is unaffected by this -- it runs on your infrastructure.
Enforcement enabled by default
Out of the box the Fabric decides and records, and the decision is advisory until you turn enforcement on. That is a deliberate default -- switching a blocking control into a live call path without the operator asking for it is how you take down production -- but it means an unconfigured tenant is observing, not enforcing. Worth knowing before you assume you are protected.
Formal verification of the whole decision path
ActionProof discharges real SMT queries about specific constraints. That is not a proof that the platform is correct, and we do not describe it as one.
24/7 staffed on-call
Alerting is automated; the humans behind it are a small team, not a follow-the-sun rota. Our published response targets reflect that rather than flattering it.
Contractual uptime SLA with financial penalties
We publish measured availability and latency objectives and the real numbers behind them. We do not currently offer service credits. An SLA nobody has the operational maturity to honour is a liability, not a feature.
Why publish this
An enterprise security review is going to surface all of it anyway. Publishing it first costs us nothing we would have kept, and it is the only evidence we can offer today that the rest of our claims are not inflated either — a vendor willing to write this page is a vendor whose other pages mean something.
What we do claim, and how to verify each of it, is on the mission page and in the architecture reference, where every trust domain publishes its coverage gaps in the API alongside its capabilities.