Provenance is the product
How Goodwattle verifies provenance.
Before anything is offered to a buyer, we check who owns it, whether it has been public, what is third-party and what personal information it holds. This is the standard we apply.
Good things grow from good work.The checks, in order
Seven checks before delivery.
- 1
Ownership
Who wrote it, under what employment or contract, and whether IP was assigned. We ask for the documents that show the chain.
- 2
Never public, never licensed
We compare the repository with public code hosts and ask the owner to attest that it has not been published or licensed for AI use.
- 3
Third-party code
Vendored dependencies, copied code and licence headers are identified with SPDX scanning, and third-party material is excluded.
- 4
Secrets and personal information
Keys, tokens, emails, phone numbers, tax file and IRD numbers and other identifiers are removed or replaced, and counts are logged.
- 5
History and review
Commits, contributors, history span and reviewed pull requests or changelists are counted from the repository itself, not self-reported.
- 6
AI authorship
The owner discloses any substantial AI-generated share, and we look for signs of it.
- 7
Legal review
Rights and scope are reviewed before delivery. Anything uncertain is left out.
The manifest
What we record.
Each asset is delivered with a manifest of these fields.
| Field | What it records |
|---|---|
| Language mix | Share of original source lines by language. |
| Lines of code | Original source, excluding vendored, generated and third-party code. |
| Reviewed PR count | Merged pull requests or changelists with at least one human review. |
| History span | First and last commit dates, with gaps and rewritten history flagged. |
| Contributor count | Distinct human authors after merging duplicate identities. |
| Test ratio | Test files and lines relative to source. |
| Licence scan result | SPDX identifiers, licence headers and vendored code found, with exclusions listed. |
| PII scan result | Secrets and personal identifiers found and removed or replaced, with counts. |
| Provenance attestations | Ownership chain, never-public and no-prior-AI-licensing statements from the owner. |
Out of bounds
What we never buy.
- Code or data you don’t own or can’t license
- Customer personal data
- Health records and other sensitive information
- Material a client, publisher or platform agreement forbids you to offer
- Credentials and secrets (these are removed, never delivered)
For owners: nothing is uploaded until you choose to share it, and a detailed review only happens after confidentiality is agreed.
Try it yourself
Get a feel for it first.
Browser-only and illustrative. Nothing is stored or sent unless you choose to.
Repository provenance check
A local script that measures your repository and never uploads your code.
Open the repository provenance checkRights checker
A few questions to work out whether the work is yours to offer.
Open the rights checker
Owners and buyers
Provenance you can check.
Terms you can read.
Owners can start with a short enquiry. Buyers can send a brief.