Duress Evidence · Honest status
Where this actually stands
The short version. The verifier proves that a disclosure bundle is internally consistent — its segments hash to a sealed Merkle root, its manifest is signed, and the manifest is included in an append-only transparency log under a signed tree head. It does not yet prove there is one true log rather than a different one shown to each reader. Until independent witnesses are established, the best verdict any check will ever return is STRUCTURE VERIFIED (unwitnessed v1) — never a plain "verified".
-
Not established
Independent witness cosigning
Not established in v1. Witness cosignatures are what would prove there is a single true log rather than a split view — a different log presented to each reader. Until the witness scheme is live, the verifier caps at STRUCTURE_VERIFIED and says so on every result. It proves append-only structure and valid signatures, not one-true-log.
-
Off
Live incident streaming
Provider-gated off. The live-view slot renders "stream not yet connected" until an incident carries a stream, and the streaming service is a separate workstream that is not switched on. No incident is streaming today, and no page should imply one is.
-
In place
Data residency
Australia. Evidence and reports are held in AWS Sydney (ap-southeast-2). The infrastructure is provisioned in-country by design; nothing about evidence storage is served from outside Australia.
-
App-enforced
Tenant isolation
Application-enforced, not database row-level security yet. The evidence store is single-role, and the separation between one organisation's evidence and another's is enforced in the application layer rather than by the database itself. That is a real boundary, but it is not the database-level isolation the main platform uses, and it should not be described as such until the tracked hardening ships.
-
Self-attested
Signing keys
Bundle-supplied unless you obtained them independently. The public keys used to check signatures usually arrive inside the bundle itself. A bundle that is internally consistent is not the same thing as a bundle from us — cross-check the keys against an independent source before relying on a signature.
-
Recorded, not verified
Device capture signatures
Recorded, not yet verified. A capture device's own signature is stored and shown, but the verifier does not check it — device key attestation is a later phase. The verifier marks it as recorded rather than pretending it was verified.
You can check any of this yourself. The offline verifier runs entirely in your browser, with the network cable pulled out, and reports every one of these limits on the face of its result. That is the point: you do not have to trust us to check what we hand you.