Skip to content
Certus
Start free

Merge what was proved.

Certus diffs your change against BASE, sends a fleet of synthetic users through both, and merges only what the recorded evidence proves.

Start freeSee how it works
(1)BASEmain@4e1a0c2HEADcrop-tool@9c1f7b3only the change counts(2)BASEHEADthe same journeys on both(3)exactevidence decides∴VERIFIEDQED

Every change is proved against the code it replaces.

Certus boots BASE and HEAD as twin sandboxes from the same recipe and runs the identical plan on both, at the same moment.

Only what your change caused counts. A check that also passes on BASE proves nothing, so it is reported INCONCLUSIVE, not a pass.

one recipe.certus/env.yamlBASEmain@4e1a0c2HEADcrop-tool@9c1f7b3one journey:crop the selected regionopen editorselect regioncropBASEHEADa status check200 OK200 OKINCONCLUSIVEproves nothingthe crop itselfno region640×480 regioncounts

A fleet of synthetic users does what your users would.

AI-driven synthetic users open your app in real browsers and click, type, and upload through the journeys your change touches, on BASE and on HEAD, in parallel.

Every session records its trace, video, network requests, and console. The AI steers the fleet; what the sessions record is the evidence.

planopen the image editorBASEHEADselect a regionBASEHEADcropBASEHEADsaveBASEHEADupload a new photoBASEHEADrecorded evidence

One session, up close.

Each step the synthetic user takes on HEAD is recorded as evidence, so what gets checked is what actually happened.

/editor/photo-181CropSave234journey:cropHEADcrop-tool@9c1f7b31traceopens the editor2screenshotdrags a selection3networkclicks Crop4consoleclicks Saverecorded, then checked

AI drives. Evidence decides.

The AI plans what to test and steers a fleet of synthetic users through the journeys your change touches. It never decides a pass.

Deterministic oracles check the evidence the fleet recorded on BASE and HEAD, and only they can pass a claim. The verdict is graded, signed, and replayable.

AI plans and drivesplannerevidenceoracleexact∴VERIFIEDQEDno arrow from the AIinto the verdict
  • VERIFIEDproved
  • VERIFIED_WITH_DEBTproved, debt carried
  • FAILEDproved wrong
  • INCONCLUSIVEproved nothing
  • BLOCKEDcould not run

Every verdict is signed and replays with certus replay.

Start free. Pay for the proof you run.

One price for the whole team, with credits for managed AI and sandbox compute. Top up in the app when you need more.

Billed

  • Starter

    For one team proving its first repositories.

    $0per month

    Models
    Certus-managed models or your own keys
    Credits
    600 a month, then $10 per 1,000
    • 2 private repositories, unlimited public
    • GitHub check and CLI
    • All five verdict statuses and grades A to E
    • Every verdict challenged by a second model family
    • Policy as code in .certus/policy.yaml
    • 7-day evidence retention
    Start free

  • Team

    For platform teams that gate merges on proof.

    $79per month for the whole team

    Models
    Certus-managed models or your own keys
    Credits
    5,000 a month, then $10 per 1,000
    • Unlimited developers and repositories
    • Top up in the app, or turn on auto top-up
    • Proof debt tracked across pull requests
    • Replay any run from its signed manifest
    • MCP server for your coding agents
    • 90-day evidence retention
    Start 3-day trial

  • Enterprise

    For organizations that keep the data plane in their own cloud.

    Customannual agreement

    Models
    Certus-managed models or your own keys
    Credits
    Committed annual volume
    • Sandboxes in your VPC
    • Your own keys through Amazon Bedrock, Azure OpenAI, or Google Vertex AI
    • SAML single sign-on and SCIM provisioning
    • Unlimited manifest retention and audit export
    • Private recipe library
    • A named support engineer
    Talk to sales

One credit is one cent of retail value. Plan allowances reset each month, including on annual billing, and top-ups last 12 months. With your own keys, model calls draw no credits; sandbox compute still draws credits, and the keys never enter a sandbox.

Stop merging on a green check.

A green check says the tests ran, not what they proved. Certus diffs your change against BASE, sends AI-driven synthetic users through both, and lets the recorded evidence decide.

diffBASEHEADsynthetic userson BASE and HEADevidence decidesexactQED
Start freeTalk to sales

Starter is free with your own model keys.