Privacy
What we store, and what we don't.
Effective 3 September 2026. We store the minimum needed to run a verification register, and we say exactly what that is.
Executives (account holders)
- Work email address — used to sign in and as your always-on challenge channel. Never shown publicly.
- Handle, display name, role, optional photo URL — public by design; that is the page.
- Challenge channels (Telegram chat id, browser push subscription) — stored encrypted at rest. Never public.
- A signing keypair generated for you. The private key is stored encrypted; the public key seeds your seal's ring.
- Assertions — the signed records of each check, including when and by what method.
- Challenges — the verifier's description, the outcome, and the time. Denied challenges are shown to you as incidents.
- Evidence you upload for a badge (PDF, PNG or JPG, up to 10 MB) — the certificate, filing or letter a reviewer needs to judge the claim. Never public.
Evidence files
Files you attach to a badge application are stored outside the web root under a random name, never alongside the site's public files, and we record a sha256 hash of each one. Only a signed-in platform admin can download a file, and only by its id; there is no public or shareable link. We delete the file 12 months after the badge it supported expires or is withdrawn. Evidence behind a badge that still stands, or that is still under review, is kept until that badge lapses.
We keep the decision record after the file is gone: the file's name, its hash, its size, who uploaded it, when, and which badge it supported. That is how we can still say what a past decision was based on. The review desk shows the record with the file marked as deleted and the date it was deleted.
Verifiers (no account)
- Your challenge description and, if you give one, your email — used only to send you the outcome.
- Page views, seal scans and challenge openings are logged with a salted hash of your IP address and browser identifier, never the raw values. We cannot reverse them.
What we do not do
- No advertising, no tracking pixels, no third-party analytics scripts.
- No sale or sharing of data. Organizations that claim their domain see only the executives registered on that domain and the challenge outcomes concerning them.
- No identity documents at Tiers 1a/1b. Where identity checks are offered, they are performed by a named provider under their own notice, and we keep only the result.
Retention and deletion
Sign-in links expire in 15 minutes and are purged after 7 days. Rate-limit records are purged after 2 days. Assertions expire after 12 months unless renewed. Evidence files are deleted 12 months after the badge they supported expires or is withdrawn, as described above. Deleting your account revokes every assertion, retires your seal, and removes your channels; the public page then states that the entry was retired.
Where it runs
On infrastructure we operate. Email is delivered by the SMTP provider configured for the register; Telegram and browser push go through those platforms' own services.