> For the complete documentation index, see [llms.txt](https://sdk.metamarket.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sdk.metamarket.tech/architecture-and-trust/trust-and-due-diligence.md).

# Trust and Due Diligence

A security or procurement review needs two things from a vendor: what can be verified up front, and a clear way to get the rest. This page gives both.

## What you can verify up front

The parts of the security model that do not depend on a deployment are documented in full, because they are structural. Each game is isolated as its own tenant. Players authenticate with a device-held key and proof of possession; an application authenticates with a separate server-to-server credential that never reaches a game client; and traffic is encrypted in transit. [Security and tenant isolation](/architecture-and-trust/security-and-tenant-isolation.md) is the model a technical reviewer reads, and [Authentication](/evaluate-and-integrate/authentication.md) has the mechanics.

## What a review covers

Anything specific to a deployment or a contract is handled through a review with the team rather than published, because the honest answer depends on the partner and the environment. That review covers the security and data-handling posture, the access-control model in the detail a reviewer needs, and the hosting, monitoring, and recovery arrangements agreed per game. The operational side of that is set out in [Production Operations](/architecture-and-trust/production-operations.md). Early integrations run directly with the team, so a reviewer speaks with the people who operate the platform.

Bring the questions your process requires. To start a review, [get in touch](https://metamarket.tech/#contact).

## Reporting a vulnerability

Report a suspected vulnerability privately through [SECURITY.md](/architecture-and-trust/security.md); please do not open a public issue for a security matter.