# About Attestium

Attestium is an open-source library and evidence format for remote attestation, built and maintained by the team behind [Forward Email](https://forwardemail.net), an open-source, privacy-focused email service. It exists so that anyone can check that a service runs the code it has published.

## Why it exists

An open-source service asks its users to trust that the hosted version runs the published code. Publishing the source does not prove that. Attestium turns the claim into evidence a third party can check: an attester on the server reports what it runs, and a verifier compares every fact with a public reference such as the git commit, the packages a lockfile pins or a signed release.

Forward Email uses Attestium, through Audit Status, to publish verification results for its own production servers on [status.forwardemail.net](https://status.forwardemail.net). The [whitepaper](https://attestium.com/whitepaper/) describes that deployment in its adoption section.

## Who builds it

| | |
| --- | --- |
| Maintainer | The Forward Email team, Forward Email LLC |
| Source code | [github.com/attestium/attestium.com](https://github.com/attestium/attestium.com) |
| Package | [attestium on npm](https://www.npmjs.com/package/attestium) |
| License | [MIT](https://github.com/attestium/attestium.com/blob/main/LICENSE) |
| Runtime | Node.js 18 or later, checks on Linux |
| Tests | End to end, with 100% statement, branch, function and line coverage required |

## Attestium and Audit Status

The two projects have different purposes and separate repositories. Attestium is the library and the format: the pieces to collect facts, the evidence schema and the checks against each kind of reference. [Audit Status](https://auditstatus.com/) is a ready-made tool built on it: one binary with an attester and a verifier that runs in CI and publishes reports and a status badge.

## Contact

*   **Questions, bugs and feature requests:** open an issue on [GitHub](https://github.com/attestium/attestium.com/issues).
*   **Security vulnerabilities:** report them privately as described in the [Forward Email security policy](https://forwardemail.net/security). The site also publishes `/.well-known/security.txt`.
*   **Contributions:** pull requests are welcome, as are independent implementations of the [evidence format](https://attestium.com/spec/) in other languages.

## This website

The site is static HTML built from the repository by `scripts/build-site.js` and hosted on GitHub Pages. It sets no cookies and loads no analytics, trackers or third-party resources. See the [privacy notice](https://attestium.com/privacy/).