Skip to main content

Public Trust & Security

Dralvia now publishes a dedicated public trust route at https://marketing.dralvia.tech/trust.

Use that page when you need one public place to verify:

  • support, security, and legal contact paths
  • the public legal notice, privacy, terms, cookies, DPA, and subprocessor routes
  • the EvidencePack (Dralvia's exportable evidence report) and transparency-log trust model
  • current deployment options
  • live status and security.txt links
  • a vendor security review section that pre-answers the common security questionnaire (data hosting and retention, workspace isolation, subprocessors, vulnerability disclosure, DPA, and current compliance posture), each with a link to the detail page. Send the trust page to a security reviewer to skip the back-and-forth.

What the page is for​

The trust page is meant for buyers, operators, legal reviewers, and security teams who need a short public summary before they dig into deeper docs or start a pilot conversation.

It is a static marketing route, not a runtime dashboard. That is intentional: the trust surface should remain available even if the product API is restarting or under maintenance.

The April 2026 marketing redesign also moved this trust route into the same wider public shell used by the homepage, pricing, request-access, and status pages so visitors get a consistent trust/legal presentation language across the whole public site.

What visitors can verify there​

Contact channels​

Those same three addresses are now mirrored on the core public trust/help surfaces:

  • marketing footer
  • public legal-page sidebar
  • marketing About page
  • product About page
  • product Help Center

The page links directly to the current public legal routes:

Evidence model​

The page explains the public evidence posture in short form:

  • EvidencePacks keep scan inputs, outputs, and reasoning together
  • transparency logs provide a verifiable record when enabled
  • human validation is still expected before irreversible customer action

Deployment options​

The page summarizes the currently documented rollout posture:

  • hosted public platform access
  • self-hosted or on-prem operation
  • enterprise custom variants including dedicated or airgapped environments where contracted

Operational reliability​

Automated safety controls, publishing controls, and connected-account authorization or setup steps preserve the latest operator and scheduler decisions when changes happen close together. Dralvia serializes those control updates so a newer safety decision is not overwritten by another automated writer.

Wall of Trust​

The Wall of Trust at https://marketing.dralvia.tech/wall-of-trust publishes reviews from people who have actually run a Dralvia scan. Every review is submitted with a work email, held for moderation, and only appears once a human approves it.

What the page shows​

A stats band sits above the reviews:

StatWhen it appearsWhat it means
Verified reviewsAlways, once there is at least one reviewCount of approved reviews. Reads "1 Verified review" when there is exactly one.
Avg trust scoreOnly with two or more approved reviewsMean of the trust scores reviewers gave, out of 100.
Would recommendOnly with two or more approved reviewsShare of approved reviews scoring at or above the recommend threshold.

Averages are withheld until there are at least two approved reviews. An average of a single score is just that score restated, and a percentage over a single sample can only ever be 0 or 100. Rather than dress one opinion up as a statistic, Dralvia shows the count on its own and adds the derived numbers once they describe more than one person. The review itself is still published immediately after approval.

Quotes are published word for word, exactly as submitted. Dralvia does not correct spelling, punctuation, or grammar in a reviewer's words, and moderators have no way to edit them: they can only approve, reject, verify, or unpublish a review. A typo in a quote is the reviewer's voice, not an oversight.

Each review card carries the reviewer's display name and a byline built from their role and company. Reviewers may withhold their name, in which case the role is shown instead and the company is derived from their email domain. Work emails are never published.

Submitting a review​

Use the review form on the Wall of Trust page. You provide a trust score out of 100, the scanner you used (URL, contract, repo, wallet, extension, or API), a short quote, and a work email. You choose whether your name is displayed. Your submission is not public until it is approved, and the security mailbox is notified of every new submission.

API equivalent​

The same data backs a public, unauthenticated endpoint:

curl "https://dralvia.tech/api/public/trust-reviews?scanner=url&limit=20"
{
  "reviews": [
    {
      "id": 12,
      "trust_score": 92,
      "scanner": "url",
      "quote": "Phishing dwell time dropped from hours to minutes.",
      "display_name": "Maya Chen",
      "role": "SOC Analyst",
      "company": "Northwind",
      "verified": true
    }
  ],
  "stats": {
    "total": 1,
    "avg_trust_score": null,
    "would_recommend_pct": null,
    "by_scanner": { "url": 1 }
  }
}

scanner and limit are optional. scanner filters the returned reviews; stats always covers every approved review, not just the filtered page.

Treat avg_trust_score and would_recommend_pct as nullable. They are null whenever fewer than two reviews are approved, and any client that renders them must handle that rather than print an empty tile. total and by_scanner are counts and are always present.

The platform asks for your cookie choice the first time you arrive, and you can change it at any time from Cookie Preferences in the console.

The panel opens with a short summary and three choices, all reachable without scrolling:

ChoiceWhat it does
Accept necessary onlyKeeps the strictly necessary identity and security cookies. Nothing optional is set.
Accept all cookiesTurns on every category, including optional analytics.
Save my preferencesApplies the category switches exactly as you left them.

Strictly necessary cookies cannot be switched off: without them a session cannot stay signed in or stay secure. Optional analytics is off until you turn it on.

Each category can be expanded to show the exact cookies and storage keys it uses, with the duration and the purpose of each one. They start collapsed so the choice comes first and the detail comes when you ask for it.

Limits​

  • The trust page is an index and summary surface, not a full legal agreement.
  • Wall of Trust averages stay hidden until two reviews are approved, so a new or filtered review set shows only a count.
  • Review moderation is manual, so an approved review can take a short time to appear after you submit it.
  • Detailed legal obligations remain on the dedicated legal routes and signed commercial documents.
  • Status and incident state still belong on https://status.dralvia.tech/.

security.txt behavior​

The marketing domain now serves its own valid machine-readable file at:

That file keeps the same disclosure mailbox and policy/encryption URLs as the primary product-domain security.txt, and includes canonical references for both domains so the relationship is explicit.