# Trust and evidence: verify mistwire before you enroll

> Follow the public trust path from published keys to installed policy and the record you can inspect, and read the limitations plainly.

Canonical: https://mistwire.io/trust  
Every page as Markdown: https://mistwire.io/llms.txt

Trust & evidence

# Verify the system before you enroll.

Follow the public trust path from published keys to installed policy and the record you can inspect. Each tile opens the underlying surface.

 All  1 Trust  2 Bootstrap  3 Bundle  4 Install  ▶ Play

### The whole public path

Start with the published signing identities, understand the bootstrap contract, inspect the exact files in the signed bundle, then verify local installation and service readiness.

[Read the skill library](https://governance.mistwire.io/skills)[Technical: raw response](https://governance.mistwire.io/v1/trust)
**What a customer is checking**

That each stage has an inspectable source and that no raw service response has to be mistaken for a customer explanation.

**Technical verification commands**

```
curl -sS https://governance.mistwire.io/v1/trust
```

```
curl -sS https://governance.mistwire.io/v1/bootstrap
```

```
curl -sS https://governance.mistwire.io/v1/bundle/stable
```

```
curl -sS https://governance.mistwire.io/v1/healthz
```

```
curl -sS https://governance.mistwire.io/v1/blob/<sha256> | shasum -a 256
```

[**My data**

The human-readable account and assembled record available to an enrolled user.

](https://governance.mistwire.io/me)[**What we process**

Categories, purpose, retention, processors, retrieval, and explicit limits.

](https://governance.mistwire.io/data)

A signed receipt binds an enrolled key, observation, bundle, time, and service verdict. It attests installed governance state; it is not a per-action activity log or proof that a customer-controlled machine reported truthfully.

Limitations

## A machine you control can misreport what it saw.

The receipt is the service's judgment of a report. If the report is wrong, the judgment is wrong with it. Here is what that looks like today, and what changes next.

 A hook is deleted on disk, but the report still lists it  A second, independent witness checks the disk too Next
**The report says**: Hook present
**The receipt says**: Compliant
**What is recorded**: The report and the disk agree.
[**Privacy & terms**Company legal surface ](https://mistwire.io/privacy)[**Modern Slavery Statement**Company statement ](https://mistwire.io/modern-slavery)