Built to be checked, including by you

A verifier is only worth something if its own claims hold up. Here's what QED Proof keeps, what it can touch, and how to check it.

What we store
Fingerprints, not content. A receipt records hashes and the facts a verifier read (a commit SHA, an HTTP status), never the code, the post or the email itself.
Read-only access
The GitHub App asks only for read permissions. QED Proof mints a short-lived token per check, scoped to your installation, and never falls back to a shared token.
Keys that don't leave KMS
The receipt-signing key (Ed25519) and the anchor wallet key live in AWS KMS. They're used through the API and can't be exported.
Tamper-evident by design
Receipts are append-only in a Merkle log that's anchored on Base Sepolia (testnet). Any edit or deletion shows up as a broken proof.
An open spec
The receipt format, the checker and the verifier profiles are open source. Anyone can check a receipt without trusting QED Proof.

Found a problem?

Report security issues to [SECURITY CONTACT]. We reply within [RESPONSE TIME].