Attestation Lookup
What a Posture Attestation says — and refuses to say.
A Posture Attestation is the signed record a customer can hand to a third party to show an assessment really happened, under a named method version, on a stated date. This page explains it plainly, and checks a reference format without pretending to verify anything we cannot yet verify.
What it is
A dated, versioned record — nothing more.
A Posture Attestation states that a named organisation's named scope was assessed under a specific, published version of the Theos Method, on a specific date, and records the resulting exposure score and tier for that scope at that moment.
That is the entire claim. It is deliberately narrow. The value of a narrow claim is that it can be checked — a broad one cannot.
What it is not
Five things a Posture Attestation never claims.
Be blunt: a Posture Attestation is easy to over-read. Here is what it explicitly does not assert, stated plainly rather than buried in fine print.
Not a certification
No accreditation body issued it. It is not SOC 2, not ISO 27001, not any third-party compliance certification.
Not an audit opinion
No auditor examined controls against an audit standard and formed an opinion. A Posture Attestation is a scoring output, not an assurance engagement.
Not a guarantee of quantum safety
It records exposure as scored on the issue date, under a stated method version. It says nothing about attacks not yet known and does not promise future safety.
Not confirmation that remediation happened
It records what was found, not what was fixed. A low score after remediation requires a new assessment, not an amendment to the old one.
Silent on anything outside scope
Assets that were never inventoried are not covered, mentioned, or implied to be safe by omission.
Check a reference
Check the format of a reference.
There is no live verification registry yet. This tool checks that a reference is shaped correctly and tells you exactly what to do next — it will never render a fake "VERIFIED" result.
Enter a reference above and check its format. This tool validates shape only — it does not query a live registry yet, and it will never tell you a reference is "verified."
Field by field
What an attestation contains.
An illustrative example, annotated. Every value below is either a fixed identifier we actually use (the method version) or a clearly marked stand-in — none of it describes a real assessment.
# Posture Attestation — illustrative example only.
# No real attestation carries this reference or these values.
reference: TQ-PA-0000-ILLUSTRATIVE # illustrative — try this in the lookup tool above
issuer: Theos Quantum Technologies Private Limited
subject_organisation: [PLACEHOLDER: illustrative — not a real customer]
method_version: theos-method-v1.0
assessment_date: 2026-07-27 # illustrative
assessed_scope: [PLACEHOLDER: illustrative — e.g. "Payments platform, EU region"]
asset_count: 128 # illustrative example, not a real result
estate_exposure_score: 58 / 100 # illustrative example — see /knowledge/exposure-score
estate_exposure_tier: Watch # illustrative — see /knowledge/risk-tiers
expires: 2027-07-27 # illustrative — pinned to method_version above
evidence_ledger_digest: sha256:[PLACEHOLDER: illustrative digest, not a real hash]
signature: [PLACEHOLDER: illustrative — signature algorithm and encoding not yet finalised]estate_exposure_score and estate_exposure_tier follow the same construction we publish in full: see how the exposure score is built and what the risk tiers mean.
How verification will work
A digest sealed to the Evidence Ledger.
Each attestation is sealed with a digest recorded in the Evidence Ledger at issuance. Recomputing the digest from the document and comparing it to the ledger entry proves the document has not been altered since it was sealed — a single changed byte produces a different digest.
That is what the digest gives you: tamper evidence. It does not give you proof that the underlying assessment was accurate, that the estate has not changed since, or that the organisation still matches the scored scope. A digest match tells you the record is intact, not that the world it describes is unchanged.
The document also carries a signature — a cryptographic seal produced by the issuer, separate from the evidence digest, that lets a reviewer confirm the record came from Theos Quantum and has not been altered in transit. The signature algorithm and how the corresponding public key is distributed are [PLACEHOLDER: signature algorithm — engineering to confirm] and [PLACEHOLDER: public key distribution mechanism — engineering to confirm]. We are not naming an algorithm or key ID here until it is actually implemented — an invented one would be worse than no answer.
When the public registry ships, a lookup here will query it directly and show the sealed record. Endpoint: [PLACEHOLDER: verification endpoint — not yet published]. Until then, use /contact for manual verification of a specific reference.
Revocation and re-issue
A superseded method means a re-score, not an edit.
An attestation is pinned to the method version active when it was issued — theos-method-v1.0, for attestations issued from its publication date onward. When the method is superseded, existing attestations are not silently rewritten to the new scoring.
The estate must be re-assessed under the new method version and a new attestation issued with its own reference and digest. The old attestation still describes exactly what it always described: a scope, scored under a named version, on a named date.
Expiry works the same way in reverse: every attestation carries an expires date, and an expired attestation does not become invalid retroactively — it simply stops speaking to the estate's current state after that date.
Revocation is a separate, narrower action, reserved for cases such as a discovered scoring error or evidence that the assessed scope was misrepresented. A revoked attestation is not deleted or hidden. A lookup against its reference continues to show the record, now marked REVOKED, with the date of revocation — the same honesty rule that governs this whole page applies to our own mistakes.
ReadThe Theos Methodandhow the method is versionedfor the full policy.
For our broader security posture and disclosure policy, see the Assurance Center and Security & Disclosure.