Product status · 27 Aug 2026
Where CalfSec is — honestly
Lab rehearsal is closed for our demo notes app. Official MASA AL1 and AL2 are not obtained. A materials-ready pack is not a certificate.
AL1 lab materials ready
Official MASA: NOT_CERTIFIED
Product-line score 81.6
| Item | Current fact |
|---|---|
| Engine | CalfSec Shield — industrial Android APK/AAB hardening (SHD1, Dex2C/SHVM, overlay, RASP-style integrity). |
| Public demo DUT | CalfSec Notes · com.calfsec.noteapp. Not a customer production app. Not official Markor certification. |
| AL1 rehearsal | 15 Yes + 3 N/A, REHEARSAL_CLOSED. lab_submission_ready=True means an authorized lab can be briefed — it is not a Google / ADA certificate. |
| Official MASA | AL1 = false · AL2 = false · owasp_masa=NOT_CERTIFIED. Play Independent Security Review badge requires official AL2. |
| World-class scorecard | 81.6 / 100 (evidence pool). c31 stays at 3. We do not write 83.6 without a qualifying flagship A/B. |
| Cloud SaaS | Invite SaaS on calfsec.ai724.cn. Pack mode remains structural — not the android-app-shield industrial engine. MLPS Level-2 build baseline only — NOT_CERTIFIED / not filed. |
| MLPS / 等保 | Designed to GB/T 22239-2019 Level-2 controls (identity, audit, isolation, TLS). No police filing and no lab evaluation yet. Do not read as 等保二级通过. |
Claims boundary: Soft-CFF is not OLLVM. We do not claim Frida/Stalker immunity, DexGuard parity, or completed GDPR / 等保 / MASA certification.
lab_submission_ready is not a certificate.Two milestones — overseas first
Capital and engineering follow this order. China market work does not start before official overseas AL1 and AL2.
1aOverseas · official MASA AL1 on a Play-listed APK (authorized lab Validation Report).
1bOverseas · official MASA AL2 (independent lab). Badge only after AL2.
2China · 等保 evaluation/filing is a later parallel track. Today: build baseline only, NOT_CERTIFIED.