The Officers
A person you can name to your auditor.
Every account gets a primary and a backup Officer. US citizens and permanent residents, working in the US, background-checked every year, five or more years of engineering with security work or a CSSLP, OSWE, GWEB or CISSP. Their names appear on your PRs; their profiles go in your audit binder.
How the bench is vetted
Every claim on this site is a process with evidence behind it.
US-based, background-checked, named, qualified. Each one is a step in vetting, recorded on the Officer's record, and reproduced on the Dossier your auditor reads.
Identity and residency
Identity verification; proof of US citizenship or permanent residency and US work location. Needed for the US-persons claim and for CMMC customers.
Background checks
Criminal (7-year, county and federal), employment and education checks through a licensed screening vendor, refreshed annually. The dates are on the Dossier.
Experience and credentials
Five or more years of software engineering with security work, or a recognized credential: CSSLP, OSWE, GWEB, CISSP.
Technical screen
Two timed PR reviews against a sample model, scored against the decision standard. Target pass rate under 25%.
Agreements
A written confidentiality and conflict-of-interest agreement, signed per customer before the Officer sees a PR.
PSCO certification
Secure coding review, the frameworks in scope, the console, and the decision standard. Quarterly refreshers in a training environment of synthetic repos.
Sample profiles · anonymized
Two Officers, the way your auditor sees them.
Public profiles show the public ID, GitHub login, role, state of work, credentials, experience and the dates of the last background check and certification. Names are abbreviated on the public page; the Dossier carries the full record under NDA.
- Public IDPSCO-0147
- RoleLead · runs Deep Reviews and QA
- LocationNorth Carolina, United States
- Background checkIdentity · criminal · employment · education, annual
- Experience11 years, former AppSec lead at a payments company
- CredentialCSSLP
- ConfidentialitySigned per customer
- Public IDPSCO-0203
- RoleBench · Standard and Attest reviews
- LocationTexas, United States
- Background checkIdentity · criminal · employment · education, annual
- Experience7 years, backend, offensive security certified
- CredentialOSWE
- ConfidentialitySigned per customer
The Officer Dossier
One letter a year, for the audit binder.
An annual Officer Dossier letter covering every Officer who touched your PRs: background checks, US residency, qualifications and training. Produced by PSCO on request, without you assembling anything, alongside the full population of attestation records.
What the Dossier records, per Officer
- IdentityVerified; US citizenship or permanent residency confirmed
- Work locationUS state of work
- Background checkVendor, scope and date of the most recent check
- ExperienceYears of engineering, security work summary
- CredentialsCSSLP, OSWE, GWEB, CISSP as held
- CertificationPSCO certification date and last refresher
- ConfidentialityAgreement signed for your organization, with date
- QASampling score and findings rate for the period
Quality control · reported to you monthly
Three mechanisms, so two minutes is a review and not a formality.
A lead re-reviews 5% of Standard approvals and 100% of Deep Reviews within 48 hours, scored against a rubric.
An Officer whose Request Changes rate on Standard PRs falls below a per-account baseline is flagged for coaching. Rubber-stamping shows up first as silence.
Any production incident you attribute to a merged PR triggers a root-cause review of the approval and a model update.
Primary and backup
Every account has a named primary and backup Officer. The backup takes over after 30 minutes idle.
Supervision
A lead supervises up to eight bench Officers and runs Deep Reviews.
Shifts
6am to midnight ET, seven days, from launch. Always-on adds overnight shifts.
Officers never push
Officer GitHub accounts are PSCO-managed, 2FA enforced, and monitored: any push by an Officer login pages the on-call lead and you.
Meet your Officers on day one.
Connect GitHub, see your price, and your primary and backup Officers are introduced at the kickoff call.