The principles every Startvest product is built and operated under.

We won't sell certification artifacts as the product.

If a buyer pays us, what they're paying for is actual compliance, security, or audit-readiness. The artifact (report, badge, attestation) is evidence of that work, not the product itself. A product whose value collapses if you can't generate the artifact is not a product we'll build.

We won't certify our own customers.

The auditor and the audited cannot be the same entity, and the relationship cannot be financial. We sell tooling that helps customers prepare for verification by genuinely independent third parties. CPAs, accredited assessors, regulators. We do not issue the certifications ourselves. This is the structural conflict that destroyed multiple compliance categories. We won't enter it.

We won't accept customer attestation as proof of verification.

When our product says something is verified, it means we mechanically verified it through evidence we collected and timestamped. Not because the customer told us so. When customer attestation is the only available signal, we label it explicitly as customer-attested, not as verified.

We won't ship AI-generated compliance outputs without human review.

AI is a useful tool for compliance work. It is not a substitute for accountability. Every AI-generated output that becomes part of an attestation, report, or compliance claim passes through a documented human review gate first. We log who reviewed it and what they changed. If we can't review it, we don't ship it.

We won't price in ways that reward skipping work.

“Unlimited audits for $X/year” is the marketing claim that creates structural pressure to fake the work. Our pricing ties to actual work performed, with transparency on what the customer gets. Margins don't compress as customer count grows beyond our capacity to do the work properly.

We document our methodology publicly.

Every Startvest product publishes the methodology by which it produces compliance outputs. Not the source code. The methodology. Customers, prospects, and competitors can read exactly what we do and how. Hidden methodologies are how shortcuts get hidden.

We refund when we're wrong.

Every customer contract includes a refund clause. If our verification turns out to be wrong because of our error or oversight, we refund. This isn't generosity. It's the structural mechanism that ties our revenue to the quality of our work.

We get audited ourselves, annually, by independent third parties.

Once per year, every Startvest compliance product is reviewed by a real third-party CPA firm or security firm. They review our methodology, sample our outputs, and publish findings. We pay for it. We publish the results. Whatever they find.

We require a compliance owner on the customer side before we sell.

Before we sell to a company, we identify who there is responsible for the compliance outcome. A CISO, a compliance officer, someone whose job depends on the outcome being real. We don't sell to companies where compliance is “operations' problem.” That's how customers end up with worthless certifications.

We make verification states distinct.

Compliance products tend to silently default to “verified” when verification fails. Ours don't. Every compliance status in our products distinguishes between verified, unverified, failed verification, and customer-attested-only. The UI shows all four states. Reports label them. We never collapse them into a single “compliant” stamp.

We give the communities we work with free access.

Free tiers for high-trust communities (veteran-owned businesses, disability-rights advocates, public-sector organizations) aren't marketing. They're accountability. Communities watching our work catch fakery faster than auditors do. We invite that scrutiny.

We publish our kill criteria.

For every product we operate, we publish the criteria under which we'd shut it down. Error rate thresholds. Customer satisfaction floors. Regulatory response windows. We tell you in advance what would make us walk away from a product, so you know we'd rather sunset it than damage your compliance posture.

We document our integrity status per product.

Every Startvest product has an INTEGRITY.md file in its public repository. It states which of our principles are implemented, where, and how. If a principle isn't implemented, it says so. The file is part of every release.