A four-layer cryptographic proof stack designed for independently verifiable outbound data workflows.
The stack combines Ed25519 digital signatures (NIST FIPS 186-5 aligned) per receipt, HMAC-SHA-256 tenant-bound chain linking, RFC-6962-style Merkle transparency witnessing published to a publicly accessible transparency repository, and OpenTimestamps Bitcoin anchoring for external time attestation. Together these layers provide independent proof of existence, proof of inclusion, externally anchored timing evidence, and full offline verifiability — all without disclosing customer content.
The architecture is designed to support privacy-preserving auditability requirements associated with frameworks such as the EU AI Act, GDPR Article 30, SOC 2 CC7.2, and ISO 27001 A.12.4.
The proof survives even if NoData ceases to operate.
Each layer states what it proves — and what it explicitly does not expose.
Four criteria for a privacy-preserving audit trail.
These four criteria together define the design space for a verifiable audit trail that also preserves operational privacy — relevant to requirements associated with EU AI Act, GDPR Article 30, SOC 2 CC7.2, and ISO 27001 A.12.4. Vendor-controlled audit logs cover only part of this space. Public blockchain notarization covers timing but often exposes content. NoData's stack is designed to combine all four into a single verification architecture.
Where each criterion sits across named alternatives.
Traditional workflow and e-signature platforms typically rely on vendor-controlled audit logs and centralized trust assumptions. Public blockchain notarization systems can provide external anchoring, but often do not preserve operational privacy, recipient-level governance, or revocable delivery control. NoData combines cryptographic proof, privacy-preserving delivery, recipient-bound workflows, and continuous outbound control into a unified verification architecture — the matrix below maps each criterion across named alternatives.
Every receipt remains independently verifiable.
The Ed25519 public key is at /api/chain/pubkey (mirrored), the Merkle roots are on GitHub at proofbydefault/witness-feed, the Bitcoin attestations are on the Bitcoin blockchain, and the open-source verifier in witness-feed/verify.mjs runs in any browser or Node.js with zero NoData dependency.