---
title: "Trust — AI Crawler Index"
description: "What can be verified about this host from outside, in three curl commands, and the list of things it does not have: no certifications, no SLA, no company, no support contract."
canonical: "https://www.pathwren.workers.dev/trust"
url: "https://www.pathwren.workers.dev/trust.md"
format: "markdown"
source: "the bytes of /trust, in the build that wrote the page"
generator: "surfaces/ai-crawler-index/build.py"
generated: "2026-09-03T07:55:35+00:00"
license: "CC0-1.0"
---

# Trust

> What can be verified about this host from outside, in three curl commands, and the list of things it does not have: no certifications, no SLA, no company, no support contract.

Everything claimed below can be checked from outside, right now, without an account:

```bash
curl -s https://www.pathwren.workers.dev/stats.json      # who actually visits — external clients only, ours excluded
curl -s https://www.pathwren.workers.dev/status.json     # when each mirrored upstream last answered, and which failed
curl -s https://www.pathwren.workers.dev/documents.json  # every document, its sha-256 and when its bytes last changed
```

## What this host does not have

Stated first, because a trust page that buries it is not one. There is
**no SOC 2 report, no ISO 27001 certificate, no penetration test report, no external audit of any kind, no SLA, no uptime commitment, no support contract, no insurance, no data processing agreement on offer and no company to sign one.** Nothing on this host is
certified by anybody, and no such claim will appear here. If your process requires one of
those documents, this project cannot supply it, and that is the end of the answer rather than
the start of a negotiation. [/compliance](https://www.pathwren.workers.dev/compliance) lists the usual asks one by
one, and what exists in place of each.

## What it does have

- **Provenance on every mirrored file.** Each IP-range mirror keeps the
upstream URL, the operator's own timestamp, our fetch time and a SHA-256 of the bytes we
received. A source that fails keeps its last known prefixes and is marked failed on
[/status.html](https://www.pathwren.workers.dev/status.html), because a prefix list that silently shrinks is worse
than one that is visibly stale.
- **Published validators.** [/documents.json](https://www.pathwren.workers.dev/documents.json)
gives a strong ETag and a Last-Modified for every machine document, so you can tell what
changed without fetching it, and [/changes.json](https://www.pathwren.workers.dev/changes.json) answers the same
question from a cursor.
- **Public numbers.** Our own traffic counts are public and exclude our own
requests: [/stats.json](https://www.pathwren.workers.dev/stats.json).
- **No moving parts.** A Cloudflare Worker in front of static files. No origin
server, no application runtime, no database in a request path, no accounts, no cookies, no
sessions, no forms, no uploads — so there is no credential of yours here to lose. The full
posture, including which probe paths are 404 on purpose, is at
[/security](https://www.pathwren.workers.dev/security).
- **Everything is CC0.** If this project disappears tomorrow, the data is
already yours: one file, [/data/agents.json](https://www.pathwren.workers.dev/data/agents.json), no attribution
required.

## Where this host is degraded right now

The live counter is the one thing here that can be unavailable, and it is unavailable more
often than we would like: the free-tier database behind it has a daily read allowance, and
when that is spent [/stats.json](https://www.pathwren.workers.dev/stats.json) answers `503` with
`"counts temporarily unavailable"` and the `#live` block on every page
says the same in words. **It never prints a zero and never prints a stale number instead.** Documents are unaffected — they are static files and keep being served —
and the counter returns on its own at the next UTC day. If the first curl above gives you a
503, that is this, and it is the honest failure mode rather than a broken one.

## Who else touches a request

Cloudflare, and nobody else: it hosts the worker, the static files and the database the
request log is written to. There are no analytics vendors, no advertising networks, no tag
managers, no third-party scripts and no data sold or shared —
[/privacy.json](https://www.pathwren.workers.dev/privacy.json) lists all three of those as empty arrays and is
regenerated on every rebuild.

## What is recorded about you

One row per request, written at the edge before anything is served: time, path, query,
user-agent, referer, accept header, status, bytes, and a *salted* SHA-256 hash of your
address, truncated. The raw address is never stored and never served. There is no automatic
deletion configured today, and [/privacy.html](https://www.pathwren.workers.dev/privacy.html) says so in those
words rather than implying a retention policy that does not exist.

## Availability, honestly

Free-tier hosting, roughly 100,000 requests a day shared by everything at this address, no
rate limit configured, best effort, no guarantee. If availability is ever threatened a rate
limit will be added and named in [/terms.json](https://www.pathwren.workers.dev/terms.json) rather than applied
silently.

## If something is wrong

Vulnerability reports, data corrections and takedown requests go to
`pathwren@tutamail.com` or through
[/.well-known/security.txt](https://www.pathwren.workers.dev/.well-known/security.txt). Corrections to the data are
treated as security-adjacent, because a wrong token or a stale prefix makes somebody's block
fail open.

Asked for by `Mozilla/5.0 (compatible; apievangelist-security-probe/1.0)`
at 2026-09-01T11:59:36Z, alongside [/security](https://www.pathwren.workers.dev/security) and
[/compliance](https://www.pathwren.workers.dev/compliance), and by
`spanly-enrich/1.0 (+https://spanly.com)` earlier the same day.

## Sitemap

- [Full sitemap (XML)](https://www.pathwren.workers.dev/sitemap.xml) — every page, with dates
- [Full sitemap (markdown)](https://www.pathwren.workers.dev/sitemap.md) — the same map, readable
- [llms.txt](https://www.pathwren.workers.dev/llms.txt) — the whole host in one text file
- [documents.json](https://www.pathwren.workers.dev/documents.json) — every document, with its ETag
- [A2A agents](https://www.pathwren.workers.dev/a2a.html)
- [About and method](https://www.pathwren.workers.dev/about.html)
- [API](https://www.pathwren.workers.dev/api.html)
- [Changelog](https://www.pathwren.workers.dev/changelog.html)
- [Compliance](https://www.pathwren.workers.dev/compliance)
- [Contact](https://www.pathwren.workers.dev/contact)
- [Impressum · Anbieterkennzeichnung](https://www.pathwren.workers.dev/impressum)
- [AI Crawler Index](https://www.pathwren.workers.dev/index.html)
- [No model runs here](https://www.pathwren.workers.dev/inference.html)
- [Legal](https://www.pathwren.workers.dev/legal)
- [MCP server](https://www.pathwren.workers.dev/mcp-doctor.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-lint.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-netcheck.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-robots.html)
- [MCP transport: the GET and HEAD leg](https://www.pathwren.workers.dev/mcp-transport.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-triage.html)
- [MCP server](https://www.pathwren.workers.dev/mcp.html)
- [Packages](https://www.pathwren.workers.dev/packages.html)
- [Pricing](https://www.pathwren.workers.dev/pricing)
- [Privacy](https://www.pathwren.workers.dev/privacy.html)
- [API reference](https://www.pathwren.workers.dev/reference)
- [Access, keys and sign-up](https://www.pathwren.workers.dev/register)
- [Security posture](https://www.pathwren.workers.dev/security.html)
- [Upstream status](https://www.pathwren.workers.dev/status.html)
- [Terms of use](https://www.pathwren.workers.dev/terms.html)
- [Trust](https://www.pathwren.workers.dev/trust)

## Machine copies of this page

- [HTML (canonical)](https://www.pathwren.workers.dev/trust)
- [JSON](https://www.pathwren.workers.dev/trust.json)
- [Markdown](https://www.pathwren.workers.dev/trust.md) — this document

This document is a markdown rendering of [https://www.pathwren.workers.dev/trust](https://www.pathwren.workers.dev/trust), generated from that page's own bytes in the same build. The HTML page is canonical.