TestifySec Platform

What it does

The TestifySec Platform is a software supply chain attestation platform that checks the work behind human- and AI-written code before a change is accepted. Its CI/lock tool records builds, tests, and scans as signed in-toto attestations, and Pushgate refuses a git push that lacks the evidence an assigned policy requires. The platform manages those gates, signing identities, and evidence across repositories and maps technical test results to controls such as FedRAMP 20x Key Security Indicators (KSIs) and NIST 800-53.

How it works

CI/lock wraps existing build, test, and scan steps and records what each step ran, read, and produced as a signed in-toto attestation, including software bill of materials (SBOM) and Supply-chain Levels for Software Artifacts (SLSA) provenance evidence. Each attestation is signed with a short-lived keyless certificate from a Fulcio certificate authority, timestamped by an RFC 3161 timestamp authority, and stored in Archivista. Pushgate checks the signer, commit binding, and required evidence against signed Rego policies before accepting a push. A GitHub pull request check flags code changes that affect mapped compliance controls.

Credentials and traction

TestifySec holds the Authority to Operate on AWS partner designation through AWS's Global Security and Compliance Acceleration (GSCA) program and sells to regulated and federal software producers, including through AWS Marketplace. Autodesk uses Witness and Archivista, open-source in-toto projects created by TestifySec, to collect CI/CD provenance that supports the supply-chain requirements of its FedRAMP authorization. The TestifySec team co-authored NIST SP 800-204D on supply chain security for CI/CD pipelines.