How it works
No sensitive data ever leaves your systems. The proof is generated where the data lives and verified independently by anyone.
01
You map your columns to the service schema in a desktop application that runs on your machine. Identities are tokenised locally with a key we never receive, so what reaches the engine is already opaque.
02
Every record is evaluated against the rule set named in the signed bundle. A skipped record is not silently dropped — it makes the proof impossible to produce, which is the whole guarantee.
03
The proof is produced from tokenised data. No balance, salary or identity enters it. Every stage is signed and chained, so tampering between stages is detectable.
04
The recipient runs a standalone verifier. No account, no network call, no contact with us — so the result does not depend on our being honest, or on our being online.
The trust boundary
Worth stating precisely, because vague privacy claims are the ones that fail a security review.
01
Identities are tokenised on your machine with an HMAC key that stays there. The engine receives tokens and computes over them.
02
The server holds the verdicts it produced and the proofs it generated. It does not hold the values that produced them. The honest framing is "the server cannot see your raw data", not "the server sees nothing".
03
A proof bundle contains no record. Whoever you hand it to learns the claim is true and nothing else — which is the point of handing them a proof rather than a spreadsheet.
One day. One proof. You decide what comes next.
