Security & trust

Evidence infrastructure should assume things can go wrong

Attestarium is designed so compromise of one layer does not silently rewrite history. Security states are explicit, sensitive data is minimised and stronger trust services remain independently identifiable.

01

Confidential by default

No public search by person, email, filename, description, date or arbitrary file hash.

Anti-probing
02

Strong account security

Password plus TOTP is required before permanent sealing. Sessions are server-side and revocable.

Step-up authentication
03

Immutable canonical store

Canonical manifests and seals are written outside the public web root and checked after write.

Tamper evidence
04

Portable verification

A DDEP package can carry the evidence manifest, signature key and trust material beyond the current domain.

No domain lock-in
05

Role separation

Provider administrators can manage the service but the design does not give them an “edit sealed evidence” function.

Operational controls
06

Supplier abstraction

Qualified timestamps, identity, payment, anchoring and storage are designed behind adapters.

Avoid supplier lock-in
Trust layers

One status should never hide five different facts

Attestarium presents platform seal time, Merkle batch state, independent anchor state, qualified timestamp state and identity assurance separately. That makes failure visible instead of pretending every green badge means the same thing.

See the complete evidence flow →

Platform sealSigned evidence commitment
Merkle inclusionShared chronology structure
Independent anchorExternal chronology reference
Qualified timestampQTSP trust material
Current build status

Working core, explicit integration boundaries

The development build already performs the evidence-core work locally and on the Attestarium service. External trust and commerce layers remain separately identifiable, so a missing provider is never disguised as a completed assurance step.

Review platform capabilities →
Working now
  • Browser-side SHA-256 hashing
  • TOTP-protected permanent sealing
  • Canonical manifests and Ed25519 platform seals
  • Adaptive Merkle batching
  • Portable DDEP export and verification
  • OpenTimestamps provider integration when enabled
Separate integrations
  • Independent Bitcoin attestation confirmation
  • Qualified electronic timestamps
  • Independent identity verification
  • Live payment processing
  • Attestarium Vault storage
Issuer identity

Attestarium issuer root fingerprint

Portable packages carry the issuer root key and an operational signing-key certificate. Compare this fingerprint through a trusted Attestarium channel when verifying outside this installation.

Verify a DDEP package →
SHA-256 root fingerprint
58c71a868ec66041a992ab0f388aa8ec71c67c295bcb9a12ba83f747b3b00823
Issuer identifier

urn:attestarium:issuer:edf4398b-0dbc-42d4-af7b-f42a9c82d244