{"what_this_is":"A plain control narrative for security and vendor questionnaires. Facts, with the public page that evidences each. Not a certification.","controls":[{"area":"What we hold about your people","statement":"Receipts are built from public files and the names or keys you submit. We store the submitted names/keys, the receipt, and (for a watch or roster) the contact email. We do not collect SSNs, dates of birth or consumer-report data, and we never read restricted files (Death Master File, CMS Preclusion, DEA registrants, FinCEN BOI, Treasury Do Not Pay).","evidence":"https://alphacovenantholdings.com/api/public-record/known-limits"},{"area":"Person-level rows","statement":"This platform is built for organizations: prebuilt and public receipts are organizations only, there is no person search, no person profile and no index of individuals across receipts. An individual's row appears on a receipt only when the publishing agency prints it under the exact name that was queried (OIG LEIE and state Medicaid exclusion files list people by design), and it is printed as the agency printed it — never enriched, never joined to another person-level source, and shown as a same-printed-name row, not as the subject, whenever the subject is an organization. Whether such a row is the person in front of you is the reader's question; we do not answer it.","evidence":"https://alphacovenantholdings.com/api/public-record/known-limits"},{"area":"Written policies","statement":"Information security, access control, incident response and change management policies are published as documents describing the controls actually in place, with the gaps named (one operator, no second responder, hosting provider controls not attested by us). A software bill of materials with declared licenses and a full-registry freshness distribution are published beside them.","evidence":"https://alphacovenantholdings.com/api/trust/policies"},{"area":"Direct sources only","statement":"Every line on a receipt is read from the publishing agency's own file or endpoint. We do not buy scraped or aggregated proxy data, do not bypass CAPTCHAs or bot walls, and do not use a browser disguise to reach a page that answers programs with HTTP 403. When an official source is unreadable it is printed as not read, with the official page, and nothing stands in for it — today that includes the FCC Covered List, FERC civil penalties, CBP EAPA notices and the OSHA SVEP log. A receipt prints what the file printed; the ERP, credentialing or TPRM rule that acts on it is the customer's.","evidence":"https://alphacovenantholdings.com/api/public-record/known-limits"},{"area":"Integrity of the record","statement":"Every receipt carries a SHA-256 over its canonical JSON; anyone can recompute it from the receipt and re-run the read from the id. Each day's receipt hashes, the Daily Replay and source-change events are chained into a daily archive digest submitted to OpenTimestamps; proofs are published when Bitcoin attests them and are described as pending until then.","evidence":"https://alphacovenantholdings.com/audit"},{"area":"Change control and corrections","statement":"Source parsers and receipt fields are versioned in the method string on every receipt. Errors are corrected in public: the receipt is annotated withdrawn (body and hash kept), a ticket is logged with cause and fix, and affected rows are rebuilt. The log is append-only.","evidence":"https://alphacovenantholdings.com/corrections"},{"area":"Availability and monitoring","statement":"A self-check (Sentinel) runs continuously against the live site: source reachability, held-file freshness, job health, archive chain continuity, disk. Findings and actions are public. The Daily Replay re-reads a sample of yesterday's receipts every day and prints the misses.","evidence":"https://alphacovenantholdings.com/audit"},{"area":"Access and keys","statement":"Partner keys are stored as SHA-256 hashes; plaintext is shown once at issue. Operator actions require an authenticated session. Webhooks are HTTPS-only and signed with a body-hash header. Payment card data is handled by Stripe; we never see card numbers.","evidence":"https://alphacovenantholdings.com/api/batch/spec"},{"area":"Data residency and retention","statement":"Hosted in the United States. Receipts are retained indefinitely because they are evidence; a requester may withhold the name from the public registry at issue (id, time and hash still recorded). Held copies of public files are kept for the version history and may be deleted on disk pressure, with the hash and date retained.","evidence":"https://alphacovenantholdings.com/api/public-record/file-history"},{"area":"Subprocessors","statement":"Emergent (hosting), MongoDB (database), Stripe (payments), Resend (transactional and outreach email), Google Places API (locating an organisation's own website for outreach routing only — never a source of record), api.data.gov / GovInfo / FAC / SAM.gov (official APIs read with our keys), Google/YouTube and LinkedIn (publishing our own content only), OpenTimestamps calendars (hash submission). No analytics or advertising vendors; visits are counted by us, cookieless, in aggregate.","evidence":"https://alphacovenantholdings.com/api/visits"},{"area":"Signing keys and custody","statement":"Every new receipt's registry row carries a HYBRID signature set — ML-DSA-65 / FIPS 204 and Ed25519, both over the receipt hash, valid only if both verify — and Verifiable Credential exports carry the same proof set (ML-DSA-65 by reference implementation; no eIDAS, FIPS-validation or certification claim). Archive checkpoints carry SLH-DSA / FIPS 205. The full signing-path inventory and dated plan against EO 14412 / OMB M-26-15 is public at /api/public/cryptography.html. Both private keys are held in the application database and are readable only by the application process; there is no HSM and no key-escrow vendor. Public keys and key ids are published in the DID document; a rotation adds a new key id and keeps the old one resolvable so earlier receipts still verify. Custody and rotation are SOP-11.","evidence":"https://alphacovenantholdings.com/api/vc/did.json"},{"area":"Encryption","statement":"All traffic is TLS 1.2+; partner API keys are stored as SHA-256 hashes; sensitive personal fields we must hold (phone numbers, contact notes, signed-agreement identities) are Fernet-encrypted at rest. Encryption of the database volume at rest is a control of the hosting provider that we rely on and do not attest ourselves. Receipts themselves are public-record text and are not secret; their integrity, not their confidentiality, is what the hash and signatures protect.","evidence":"https://alphacovenantholdings.com/trust"},{"area":"Vulnerability disclosure","statement":"Report a security issue to the reference desk mailbox printed in the footer with 'security' in the subject. We acknowledge within two business days, fix or mitigate before any public note, and record the fix in the corrections log with its date. We do not pay bounties and do not pursue good-faith researchers.","evidence":"https://alphacovenantholdings.com/corrections"},{"area":"Continuity and exit","statement":"One operator is a single point of failure and we say so. The mitigation is portability: every receipt exports as a W3C Verifiable Credential that verifies against the published DID document without this site; the daily hash digests are anchored to OpenTimestamps; customers may download every receipt at any time. If the service closed, the DID document and verification page would remain published for twelve months.","evidence":"https://alphacovenantholdings.com/api/vc/did.json"},{"area":"Outreach conduct","statement":"Letters go only to a general office inbox the organisation itself publishes on its own website, never to an address built from a person's name, never to fraud, hotline, complaint, integrity or ethics inboxes, at most five new organisations a day, with the follow-up terms stated in the letter and a stop on any reply. Every letter passes a written gate that is published; the gate's checks are listed in SOP-13.","evidence":"https://alphacovenantholdings.com/api/trust/sops/changes"},{"area":"Legal entity","statement":"Alpha Covenant Holdings LLC, a Pennsylvania limited liability company (Department of State entity 0016032097, formed October 18, 2026); registered office 501 Cambria Avenue Suite #240, Bensalem, PA 19020-7213. Receipts dated before 2026-10-18 were issued under a predecessor trade-name registration; their bodies, hashes and keys stand as issued and verify unchanged. The contracting party for every service is Alpha Covenant Holdings LLC (PA 0016032097). The filing can be checked at the Pennsylvania Department of State.","evidence":"https://alphacovenantholdings.com/api/public/entity"},{"area":"Independent assurance","statement":"No SOC 2, ISO 27001 or audit report yet; the daily self-check is ours and is labelled as such. Third parties who verify an individual receipt at /verify may log that they did — the entry is theirs, confirmed from their own mailbox, and we only record it. We intend to seek an agreed-upon-procedures engagement (AICPA AT-C 215) on a sample of receipts before SOC 2; when either exists it will be linked here with its date and scope, not before.","evidence":"https://alphacovenantholdings.com/verify"}],"live":{"corrections_logged":32,"independent_verifications_confirmed":0,"held_federal_lists":13,"last_sentinel_run":"2026-10-25T16:38:34.766470+00:00","sentinel_findings_last_run":2},"no_claims":["SOC 2","ISO 27001","HITRUST","FedRAMP","independent audit"],"verify_us_facts":"https://alphacovenantholdings.com/api/record/trust","checked_at":"2026-10-25T16:50:40.924104+00:00"}