For security reviewers and vendor-management questionnaires
Trust & controls
A plain statement of how this platform is run, written to be pasted into a questionnaire answer. Every line links to the public page that evidences it. It is not a certification — see the last item.
Live: 33 corrections logged in public · 13 federal lists held with hashes · last self-check 2026-10-26 01:18 UTC with 2 finding(s)
What we hold about your people
Receipts are built from public files and the names or keys you submit. We store the submitted names/keys, the receipt, and (for a watch or roster) the contact email. We do not collect SSNs, dates of birth or consumer-report data, and we never read restricted files (Death Master File, CMS Preclusion, DEA registrants, FinCEN BOI, Treasury Do Not Pay).
Evidence: /api/public-record/known-limitsPerson-level rows
This platform is built for organizations: prebuilt and public receipts are organizations only, there is no person search, no person profile and no index of individuals across receipts. An individual's row appears on a receipt only when the publishing agency prints it under the exact name that was queried (OIG LEIE and state Medicaid exclusion files list people by design), and it is printed as the agency printed it — never enriched, never joined to another person-level source, and shown as a same-printed-name row, not as the subject, whenever the subject is an organization. Whether such a row is the person in front of you is the reader's question; we do not answer it.
Evidence: /api/public-record/known-limitsWritten policies
Information security, access control, incident response and change management policies are published as documents describing the controls actually in place, with the gaps named (one operator, no second responder, hosting provider controls not attested by us). A software bill of materials with declared licenses and a full-registry freshness distribution are published beside them.
Evidence: /api/trust/policiesDirect sources only
Every line on a receipt is read from the publishing agency's own file or endpoint. We do not buy scraped or aggregated proxy data, do not bypass CAPTCHAs or bot walls, and do not use a browser disguise to reach a page that answers programs with HTTP 403. When an official source is unreadable it is printed as not read, with the official page, and nothing stands in for it — today that includes the FCC Covered List, FERC civil penalties, CBP EAPA notices and the OSHA SVEP log. A receipt prints what the file printed; the ERP, credentialing or TPRM rule that acts on it is the customer's.
Evidence: /api/public-record/known-limitsIntegrity of the record
Every receipt carries a SHA-256 over its canonical JSON; anyone can recompute it from the receipt and re-run the read from the id. Each day's receipt hashes, the Daily Replay and source-change events are chained into a daily archive digest submitted to OpenTimestamps; proofs are published when Bitcoin attests them and are described as pending until then.
Evidence: /auditChange control and corrections
Source parsers and receipt fields are versioned in the method string on every receipt. Errors are corrected in public: the receipt is annotated withdrawn (body and hash kept), a ticket is logged with cause and fix, and affected rows are rebuilt. The log is append-only.
Evidence: /correctionsAvailability and monitoring
A self-check (Sentinel) runs continuously against the live site: source reachability, held-file freshness, job health, archive chain continuity, disk. Findings and actions are public. The Daily Replay re-reads a sample of yesterday's receipts every day and prints the misses.
Evidence: /auditAccess and keys
Partner keys are stored as SHA-256 hashes; plaintext is shown once at issue. Operator actions require an authenticated session. Webhooks are HTTPS-only and signed with a body-hash header. Payment card data is handled by Stripe; we never see card numbers.
Evidence: /api/batch/specData residency and retention
Hosted in the United States. Receipts are retained indefinitely because they are evidence; a requester may withhold the name from the public registry at issue (id, time and hash still recorded). Held copies of public files are kept for the version history and may be deleted on disk pressure, with the hash and date retained. Since 2026-10-25 a daily manifest of each day's registered receipt hashes and the signed log head is also written to an off-site object store (Backblaze B2, United States) under an Object Lock COMPLIANCE retention of seven years — a fact about the store, stated with its mode and date; receipt bodies and customer data are not copied there.
Evidence: /api/public/offsite-copiesSubprocessors
Emergent (hosting), MongoDB (database), Backblaze B2 (off-site object storage for the daily receipt-hash manifest only; Object Lock retention), Stripe (payments), Resend (transactional and outreach email), Google Places API (locating an organisation's own website for outreach routing only — never a source of record), api.data.gov / GovInfo / FAC / SAM.gov (official APIs read with our keys), Google/YouTube and LinkedIn (publishing our own content only), OpenTimestamps calendars (hash submission). No analytics or advertising vendors; visits are counted by us, cookieless, in aggregate.
Evidence: /api/visitsSigning keys and custody
Every new receipt's registry row carries a HYBRID signature set — ML-DSA-65 / FIPS 204 and Ed25519, both over the receipt hash, valid only if both verify — and Verifiable Credential exports carry the same proof set (ML-DSA-65 by reference implementation; no eIDAS, FIPS-validation or certification claim). Archive checkpoints carry SLH-DSA / FIPS 205. The full signing-path inventory and dated plan against EO 14412 / OMB M-26-15 is public at /api/public/cryptography.html. Both private keys are held in the application database and are readable only by the application process; there is no HSM and no key-escrow vendor. Public keys and key ids are published in the DID document; a rotation adds a new key id and keeps the old one resolvable so earlier receipts still verify. Custody and rotation are SOP-11.
Evidence: /api/vc/did.jsonEncryption
All traffic is TLS 1.2+; partner API keys are stored as SHA-256 hashes; sensitive personal fields we must hold (phone numbers, contact notes, signed-agreement identities) are Fernet-encrypted at rest. Encryption of the database volume at rest is a control of the hosting provider that we rely on and do not attest ourselves. Receipts themselves are public-record text and are not secret; their integrity, not their confidentiality, is what the hash and signatures protect.
Evidence: /trustVulnerability disclosure
Report a security issue to the reference desk mailbox printed in the footer with 'security' in the subject. We acknowledge within two business days, fix or mitigate before any public note, and record the fix in the corrections log with its date. We do not pay bounties and do not pursue good-faith researchers.
Evidence: /correctionsContinuity and exit
One operator is a single point of failure and we say so. The mitigation is portability: every receipt exports as a W3C Verifiable Credential that verifies against the published DID document without this site; the daily hash digests are anchored to OpenTimestamps; customers may download every receipt at any time. If the service closed, the DID document and verification page would remain published for twelve months.
Evidence: /api/vc/did.jsonOutreach conduct
Letters go only to a general office inbox the organisation itself publishes on its own website, never to an address built from a person's name, never to fraud, hotline, complaint, integrity or ethics inboxes, at most five new organisations a day, with the follow-up terms stated in the letter and a stop on any reply. Every letter passes a written gate that is published; the gate's checks are listed in SOP-13.
Evidence: /api/trust/sops/changesLegal entity
Alpha Covenant Holdings LLC, a Pennsylvania limited liability company (Department of State entity 0016032097, formed October 18, 2026); registered office 501 Cambria Avenue Suite #240, Bensalem, PA 19020-7213. Receipts dated before 2026-10-18 were issued under a predecessor trade-name registration; their bodies, hashes and keys stand as issued and verify unchanged. The contracting party for every service is Alpha Covenant Holdings LLC (PA 0016032097). The filing can be checked at the Pennsylvania Department of State.
Evidence: /api/public/entityIndependent assurance
No SOC 2, ISO 27001 or audit report yet; the daily self-check is ours and is labelled as such. Third parties who verify an individual receipt at /verify may log that they did — the entry is theirs, confirmed from their own mailbox, and we only record it. We intend to seek an agreed-upon-procedures engagement (AICPA AT-C 215) on a sample of receipts before SOC 2; when either exists it will be linked here with its date and scope, not before.
Evidence: /verifyDocuments for a reviewer: Information Security Policy · Access Control · Incident Response Plan · Change Management · Software bill of materials · Registry freshness (all receipts).
What this is: an autonomous public-records evidence utility — scheduled reads of official files, a dated and hashed receipt of what they printed, self-audit and drills, written procedures with a public change log. A person still signs anything that touches the evidence, the prices or a promise to an outsider.
Quality system: Quality Manual · 14 standard operating procedures (each with owner, review date, change log) · Records Register (who updates each record, when, retention) · procedure change notations. Not a certification.
Uptime and efficiency: how often the site answered, how fast, how often a visitor was interrupted — measured by us against six printed standards, with the misses shown.
We do not hold, and do not claim: SOC 2 · ISO 27001 · HITRUST · FedRAMP · independent audit. Machine-readable facts for reviewers: /api/record/trust · Legal · Who pays us