Company
Security
A sealed record that changes stops matching its own fingerprint. What we hold, where it sits, and what leaves.
Records seal to canonical bytes and anchor to rails we do not operate. That property is a security control as much as a trust one: a compromise of Censio cannot silently rewrite history that has already been anchored.
What the protocol guarantees, and what it cannot
What is anchored
A fingerprint of each record, batched into an epoch, committed to a qualified timestamp and, where live, a public chain. Not the record itself, and never the evidence.
What a compromise of Censio could and could not do
It could not rewrite a record that has already been anchored; the fingerprint would no longer match. It could issue new records, which is why keys are bound to institutions and every record carries its issuer.
What we cannot see
Who verifies a record. Verification runs against the anchor, not against us, and there is deliberately no telemetry on it.
What the protocol guarantees, and what it cannot
What is anchored
A fingerprint of each record, batched into an epoch, committed to a qualified timestamp and, where live, a public chain. Not the record itself, and never the evidence.
What a compromise of Censio could and could not do
It could not rewrite a record that has already been anchored; the fingerprint would no longer match. It could issue new records, which is why keys are bound to institutions and every record carries its issuer.
What we cannot see
Who verifies a record. Verification runs against the anchor, not against us, and there is deliberately no telemetry on it.
Certifications
Certifications
Our certification position is stated to counterparties under agreement and is not published on this page. We do not claim a certification we do not hold, and we do not list one as pending.