Security

Security model

ProvableCORE is fail-closed by design and keeps signing under controlled, authoritative handling.

Explore the trust model →

Trust boundary

What it is designed to prove — and what it is not

Scope

Designed to prove

That a record's origin can be established, through controlled authoritative signing.
That a proof is about this exact content, through content binding.
That a record holds a position in an ordered sequence.
That a record carries what is needed to check its proof and replay its governed sequence.

Boundary

Not claimed

It does not certify compliance and does not guarantee any legal outcome.
It does not make records impossible to remove: retention is a deployment configuration, and the trust tiers state what a record's current handling supports.
A content digest by itself is a checksum, not a signature; the trust tiers state which records carry a signed proof and which carry only a preserved record.
It records the authority under which systems act; it does not replace that authority.

Operating model

Operation, keys, preservation, disclosure

Fail-closed operation

ProvableCORE is fail-closed by design: when a proof cannot be properly constructed, signed, or preserved, the system withholds a positive result rather than issuing an unverified one. AI and automated systems act under human and institutional authority — ProvableCORE records that authority; it does not replace it.

Key handling

Proofs are signed under controlled, authoritative signing so that a record's origin can be established. Signing is operated as a controlled capability. The site makes no unconditional assertion about hardware modules or key custody.

Preservation

Signed, content-bound proofs are preserved as durable evidence records. The locked-retention trust tier describes proofs held under a locked-retention regime for a defined preservation window when configured; it is not a claim that every record is kept for an unlimited time or is impossible to remove.

Responsible disclosure

If you believe you have found a security issue, contact contact@agrocapitalstandard.eu. Please provide enough detail to reproduce the issue and allow reasonable time for remediation before public disclosure.

Request institutional access

Access is granted through a controlled onboarding process. Discuss an evaluation, review the verification model, or request technical documentation.

Request institutional access See a published evidence record →