The engine runs the battery on your runner and posts the report here. The console stores it, keeps every count derived from the findings themselves, walls off third-party results, records who signed off and when, and produces the deliverable. It never runs a scan.
Score, pass/fail, severity totals and coverage are computed from the finding rows at render time. There is no authored summary that can drift from the body.
A finding from a third-party tool is EXTERNAL in the data model, not just in a view — it can never be counted as Kloof's own result.
A deliverable comes only from a reviewed scan. Reviewer and timestamp are immutable, and reopening a scan voids the signature and records why.
Kloof is not a penetration test, and not a SOC 2, HIPAA, or ISO certification. It produces dated evidence.