CAIN-42 MCPGate
Sign inGet started
Menu
42CAIN-42 IHVRK › KEYSTONE › 4. Selling tools

KEYSTONE: selling tools

Evidence for KEYSTONE: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it

The evidence is your best sales tool: a buyer can check it without trusting you. Press Copy on any box, fill in the [brackets] and send it, one person at a time.

What to send, and when

WhenSend this
First messageA short personal note with the kit page
They reply, "show me"The live demo on a call, using the script below
"Send it to our engineer"The kit and the evidence pack
Security review or questionnaireThe answers page. Never upgrade a NO to a YES.
Finance or procurement wants recordsThe figures page and figures.tsv
Ready to go aheadThe hand-off below. The founder does the contract, price and setup.

Who to approach

Questions to ask them

30-second pitch

KEYSTONE does not just say a bug is fixed; it hands over a sealed record that proves it, which the client re-checks without trusting us.

We recorded 8 live checks, including 6 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.

Don't trust us. Check it: https://cainstudio.online/ihvrk-keystone.html

First email

Subject: closing [finding] with proof your customer can re-run

Hi [first name],

When a customer asks you to prove a security fix, most teams send a screenshot or a
ticket. We send a sealed record: a rule-based detector found the problem, an independent test fails on
the old code and passes on the new, and your customer can re-check it offline without trusting us.

Fixed price from $500 per finding. Two-minute look at what the proof looks like:
https://cainstudio.online/top25-keystone-record.html

Worth a 15-minute call?

The evidence: We recorded 8 live checks, including 6 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Check it yourself: https://cainstudio.online/ihvrk-keystone.html

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

LinkedIn connection note (under 300 characters)

Hi [name], I work with teams that need to prove security fixes to their customers, not just claim them. Our fixes come with a sealed record your customer can re-run offline. Happy to show you a 2-minute example.

One follow-up, three days later (then stop)

Hi [first name], one more thought: if any finding from your last review is still open, we can close it with a
re-runnable proof at a fixed price. Want me to send the example record so your team can try verifying it?

Live demo call script

1. Show the normal case
   Do: Open https://cainstudio.online/top25-keystone-lab.html and run: Your code: honest constant-time compare
   Say: Real code must grade REAL or nobody trusts the alarms.

2. Now the attack
   Do: Run: Sample: A signature check that never checks the signature
   Say: A deterministic detector, not the model, finds the defect the AI is then asked to fix.

3. Now the attack
   Do: Run: Sample: A metric that reports a random number as accuracy
   Say: A deterministic detector, not the model, finds the defect the AI is then asked to fix.

4. Let them check you
   Do: Send the kit link and ask them to run python3 verify.py --live on their own computer.
   Say: They don't have to take your word for any of this. That's the point.

5. Say the limit yourself
   Do: Tell them what the kit does not show.
   Say: Say it before they ask. It costs nothing and it earns trust.

When they push back

We can just ask the AI to write a test.

You can, but the same model wrote the fix and the test. KEYSTONE's proof uses an independent test the model never saw, run in a sandbox.

Can I watch it fix something live?

Live AI fixing is switched off on the public site today; the demo shows the detector live and real signed records from earlier runs. On an engagement we run it on your code.

Does it work on our language?

The detector is strongest on Python. For other languages talk to the founder before promising anything.

How many fixes has it done?

Honestly, a small number so far: the public evidence holds four fixes that meet today's rule. It proves the method; your engagement adds your own.

Isn't this what our pen-test firm does?

They find problems. We close one and hand you proof. Many clients use both.

Why should I believe your numbers?

You shouldn't have to. Run the kit on your own computer: https://cainstudio.online/ihvrk-keystone.html. It re-sends every request and compares the answers, using no code of ours.

What doesn't it do?

Written down here: https://cainstudio.online/top25-keystone-limits.html

Are you SOC 2 or ISO certified?

No, we hold no certification. What we offer instead is evidence you can check yourself.

Has anyone independent tested it?

No third-party audit has been completed. The attack cases in the kit are our own. I'd rather tell you that now.

Who else uses it?

We are an early company. I can show you the product working and the evidence, not a customer list.

It found nothing. So we're safe?

No. It means none of its checks fired. It doesn't prove something is safe.

How much is it?

Sell KEYSTONE as Fix + Prove: one finding closed, with proof the client's buyer can re-run.

One-page summary (paste into a document or email)

KEYSTONE
by FIRME AI CORPORATION, a California corporation

What it does
KEYSTONE does not just say a bug is fixed; it hands over a sealed record that proves it, which the client re-checks without trusting us.

The evidence
We recorded 8 live checks, including 6 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Recorded 2026-11-03. 8 live checks. Median round trip 67 ms including network; this is not a load test or an SLA.

Check it yourself
https://cainstudio.online/ihvrk-keystone.html
Zip SHA-256: 0a915b87eedcbcdf36137b870c5d174f6ef92562dc31dc8198afc4f1e231b17b
Signing key fingerprint: 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3
Run: python3 verify.py --live  (Python 3, no account, no code of ours)

What it does not do
Written down here: https://cainstudio.online/top25-keystone-limits.html

What this is not
Not a third-party audit, a certification or a guarantee. No SOC 2 or ISO certification is held.

Contact
[your name], working with FIRME AI CORPORATION, [your email]

After the call: the proposal email

Hi [first name],

Thanks for your time. As discussed, here is what I suggest for KEYSTONE.

What you told me: [their problem, in their words]

What we'd do: Sell KEYSTONE as Fix + Prove: one finding closed, with proof the client's buyer can re-run.

Evidence you can check before deciding: https://cainstudio.online/ihvrk-keystone.html
Answers for your security review: https://cainstudio.online/evidence-keystone-answers.html
Figures for your files: https://cainstudio.online/evidence-keystone-figures.html
Limits: Written down here: https://cainstudio.online/top25-keystone-limits.html

Next step: [date], [who]. The founder, Vincent Noriega, handles contract and setup.

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

Hand-off to the founder

To: vincent@firmeai.com
Subject: Lead: KEYSTONE - [company]

Company: [company]
Person: [name], [job title], [email]
What they said: [paste their reply]
Evidence already sent: https://cainstudio.online/ihvrk-keystone.html
Price mentioned: [what you quoted, or none]
Next date: [date]

The rules