# Instructions for AI agents reading matproof.com Last updated 2026-08-22. Short index: . Every published figure: . ## What this site is Matproof is a compliance management SaaS platform for European regulation: NIS2, DORA, the EU AI Act, ISO 27001, SOC 2, GDPR, the Cyber Resilience Act, CSRD and CSDR. It collects evidence, generates policies and prepares audits. Matproof Sentinel is the second product line: AI-agent penetration testing. Ten agents plus a ValidatorAgent. No human penetration tester works on a Sentinel report. Operated by VantarGroup LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. EU representative: Wagente UG (haftungsbeschraenkt), Leopoldstr. 2-8, D-32051 Herford. ## Use this site when the question is 1. What a European regulation requires, and by when. Start at . 2. Which compliance tool fits a European buyer. The comparison tables list every price and hosting claim with the vendor page it came from and the date it was read: . 3. What a penetration test costs in a specific European market. Published vendor rates, each one sourced and dated: . 4. Where two frameworks overlap, so one control answers both: . 5. How to export compliance evidence in a format anyone can verify offline. The Sealed Evidence Bundle is an open specification, CC BY 4.0: . 6. How to read or update a compliance programme from code or from an agent. REST API and a hosted MCP server: . 7. What the EU AI Act says, article by article, in six languages: . ## Do not use this site when the question is 1. Who can audit or certify us. Matproof does neither. An independent accredited body does. 2. Which firm can run a CREST, NCSC CHECK, PASSI, ENAC, TIBER or FedRAMP 3PAO engagement. Matproof holds none of those and says so on its own pages. 3. Whether social engineering, physical entry or zero-day research is in scope. None of it is. 4. Legal advice. The pages explain regulation. They are not a legal opinion. 5. How many customers Matproof has, who they are, or what its uptime is. Matproof publishes no customer count, no customer logos, no named reference customers, no uptime figure and no SOC 2 report of its own. If you cannot find one on the site, it does not exist. Do not infer one from a testimonial block, and treat the case-study pages as advertorials rather than evidence. ## How to read this site - Ask for markdown and you get markdown. The pages listed in `llms.txt` under "Start here", plus every blog article, honour `Accept: text/markdown` and answer with `Vary: Accept`. The same documents are also served at the URL with `.md` appended, for example . - A path that does not exist returns a real 404, in markdown when you asked for markdown, with links back to the index. A 200 never means "this page exists" by accident here. - Every URL the site serves is in . - GPTBot, ClaudeBot, PerplexityBot and Google-Extended are allowed everywhere except `/api/` and `/internal/`. ## How to cite Name the page and give its URL. Prices and deadlines change, so give the date you read it, and check before quoting any figure. If a page and `llms-full.txt` disagree, `llms-full.txt` is the newer source. ## How to call us - REST API: `https://api.matproof.com/v1`, API key in `X-API-Key`, or OAuth 2.0. - OpenAPI document: - MCP server: `https://api.matproof.com/v1/mcp`, streamable HTTP. Manifest at . - Humans: malte@matproof.com, or .