Keys
The signing key never leaves the approver's device.Not us, and not anyone who breaks into us.
How it is built, and what it satisfies.
The front page shows the product working. This is the evidence behind it.
Every claim here has a file behind it.
Identity
OIDC to your own IdP. No password is ever taken.So none is held. PKCE S256, state and nonce, all tested.
At rest
API keys stored as SHA-256, shown to you once.Console keys sealed AES-256-GCM against your org id — a row copied between tenants stops opening.
Access
Fourteen scopes, seven roles.Drilled by a test that calls the engine with each role's own key. No browser, no button to hide behind.
Runtime
Distroless, non-root, no shell, no package manager.It refuses to start if its preconditions are not met.
The log
RFC 6962, and you hold the root.Check any entry without an account, or a word to us.
Signed off
- SOC 2 readiness assessment, mapped clause by clause to the code
- NIST 800-63 AAL stated on every receipt
- FIDO2 / WebAuthn passkeys, issued by your IdP
Not yet, and we will not imply otherwise
- No SOC 2 report. The readiness assessment is what you get, and it is the better thing to hand an auditor
- No penetration test, and no dependency scanning in CI
- No mTLS option, no documented cipher policy
The signature covers the exact sentence.
Edit it below. The fingerprint changes, so a receipt signed over the original no longer matches. A real SHA‑256, computed in your browser.
Approveto
Try tampering
Fingerprint of those exact wordsSHA-256
Every character depends on every word above.
Verified. This is what Dana approved.The fingerprint matches her signature.
Verified · no account required
Approve $2,400,000.00 to NORTHWIND LOGISTICS
- Approved by
- dana@meridianfreight.com
- Bound to
- payment_approval:pay_1041
- Context hash
- edbd19a69d463f7e8f43dff24d0dc1364f668a97f1400d14e21184fa608f7c7f
- Check
- platform_passkey
- Signing key
- ed25519-edbd19a6
Every payment is scored before anyone is asked.
Move the amount and turn signals on. The weights and the rules are the engine’s own, so this is the answer production would give.
Signals
L3Attested hardwareroadmap
L2A challenge answered on this device, nowAAL2
L1A signature only that person could makeAAL2
L0Context only. Nothing proved.AAL1
Ask your systems who approved a $2.4M wire.
Eleven months later, someone asks who approved PAY-1041. Okta shows a sign-in that morning. Email shows a reply in a thread. NetSuite shows a status. The audit log shows a line written by the system being asked. Four systems show the workflow ran. None shows who ran it.
The question, put to the four systemsWho approved the $2,400,000 wire to NORTHWIND LOGISTICS, and to those exact words?
The gate, running.
Each line is one decision. Open any of them to see the receipt it produces.
Livedemonstration tenant0 / min
Every claim here has a file behind it.
Assembled, not invented. The parts are standard. Pointing them at your own irreversible act is not.
- Receipt
- Ed25519, compact JWS (EdDSA)The key that signed it is named, and still resolves after rotation.
- Approver’s key
- A passkey on a device they enrolledThe device checks it is them before it signs. The key never leaves it.
- Biometric data
- None heldThe fingerprint or face never leaves the device. We hold a public key, not a template.
- Checking a receipt
- /.well-known/presence-keysAnyone can check one. An auditor needs no account.
- First step
- Read-onlyAn export you already have. Your systems are not touched until you decide.
- Log
- Append-only Merkle logInclusion and consistency proofs. Remove an entry and watch the proof refuse.Append-only logroot —
One artifact, eleven irreversible acts.
Payments are the first, not the only one.
Your policy already names these procedures.
Three procedures are named as conditions of coverage. Here is what we produce for each.
Three named procedures. We produce evidence for all three.
What it costs when you cannot show it
The whole policy, rescinded from inception
Travelers v. International Control Services, 26 August 2022. A control was attested and could not be evidenced. The policy was declared null and void, from its inception — not the claim, the cover, retroactively.
Attestations are good. Verification is better.underwriting guidance, 2025 · your auditor is moving the same way
An audit log is real. Standing it up is the expensive part.
79% of finance teams were hit by attempted or actual payment fraud last year. Every one had an approval workflow running the whole time.
Today · to stand your log up, someone must test
With a receipt · to rely on it, someone must
Three people read it, for three different reasons.
The CFO or controller
A payment went out and nobody really approved it. Today you can prove nothing. This is the receipt.
The CISO or platform lead
Help-desk recovery, privileged access, agent authority. Same artifact, no second rollout.
The auditor or underwriter
Stop sampling the log and testing the controls around it. Check a signature.
What it does not do.
Straight answers about what it does not do
- We do not stop a deceived approver. If they are not a required signer, the payment still goes.
- We do not detect the fake. A passkey cannot tell a fingerprint from a PIN.
- No customers, no SOC 2, no pen test. A readiness assessment, which is the better thing to hand over.
- No independent witness runs yet. The monitor is built. Nobody outside this company holds a key.
- Assembled, not invented. The parts are standard. Pointing them at your own irreversible act is not.
And why not build it
Build it in-house and the key is yours, the log is yours, the clock is yours.
The moment an insurer, an auditor or a court is the reader, the build stops being evidence.
And the part that cannot be bought back
Evidence cannot be backfilled.
A competitor can match this on a Tuesday. What they cannot do is produce four years of it.
Start with an export you already have.
Avouch runs read-only first. Nothing is blocked until you choose to enforce it.