Frequently asked questions

Is BuildVouch a vulnerability scanner?

BuildVouch manages release assurance and ingests evidence from existing systems. It does not include an autonomous penetration-testing or remediation engine.

Does Connected mean secure?

No. Connected means the configured source could be read. Release readiness depends on the exact candidate's evidence and unresolved risks.

Why is my candidate blocked?

Open its decision to see each missing, failed, unknown or expired control and any unresolved findings or incidents. A newly connected application normally needs more evidence.

Why is an API submission unverified?

The API authenticates the sender and preserves the claim. That alone does not prove that the claimed test ran or passed. A configured source connector records separate verified evidence.

Can a manual note become verified evidence?

No. Manual notes retain their origin and cannot satisfy a required release control.

Can I approve my own evaluation?

No. A different organisation owner with recent MFA must approve it.

Can one organisation view another's applications?

Membership and database policies scope records to the organisation. Application tokens also have a single-product boundary.

Will BuildVouch deploy my app?

No. Its verdict and approval records support a separate release process.

Is House of Alpha part of the first pilot?

No. The first pilot is Cyclotron Technologies with four applications. HOA is a separate later customer organisation.

Does V1 send invitation emails?

No. Owners create a single-use link and share it through their approved channel.