Trust Center

This page does not ask you to trust a claim. It runs the same cryptographic checks your own script could run, in your browser, against a real signed sample, and shows you exactly what a pass and a fail look like.

What is actually proven

The attestation header

Verified

Every response carries an X-zer0pii-Attestation header: an Ed25519 signature over the timestamp, the request id, the raw-text hash, the sanitized-text hash and the word PURGED. A valid signature proves whoever holds the private key signed exactly that tuple.

The Merkle receipt and the signed tree head

Verified

Each attestation is also a leaf in an append-only Merkle log. A receipt is a proof that one specific leaf sits at one specific position in a tree; a signed tree head is the same key's signature over a (root, size, timestamp) triple. Checking the receipt against the root and size taken FROM that signed tree head, not supplied separately, is what closes the size-aliasing gap of a bare inclusion proof: a proof for a size-5 tree can also pass for claimed sizes 6, 7 or 8 unless the size itself is pinned by a signature.

Declared limit

What none of this proves

That the public key belongs to zer0pii. Key distribution (JWKS over TLS, pinning, a transparency witness) is a separate trust decision.
That any data was actually destroyed. The receipt is a signed claim by the gateway about its own behaviour, not an outside observation of it.
That the raw or sanitized hashes correspond to any particular text, unless the verifier holds that text and hashes it independently.
That the log is append-only over time or shows everyone the same view. There are no consistency proofs between tree heads here and no gossip or witnesses, so a split view or a rewritten history would not be detected by this page.
That timestamps are true. The timestamp is the gateway's own clock.

Source: apps/web/src/lib/trust/verify.ts

Verify a sample receipt yourself

This is a synthetic sample signed with a throwaway key generated for this page, not production data and not a live organization's tree. The three checks below run with WebCrypto, in this tab, on load.

Sample, signed with a throwaway key

Attestation header

t=1790520628;kid=ed25519-6bf5ad331bef;raw=sha256:18f5a4464255ae4d22f2833c677babe50147695f346394990657af3cd27bf29b;sanitized=sha256:84e21d1c5abb7fe03579b041467c86637a8ca6d9d7fdeea7d84d851bdf5a510b;status=purged;sig=ed25519:wjLEGbFzLoS9miJ0irf5wL6X2rnMUJM188O-tcWkGDz9sCD4aZt0UN4c4ScQhrIIYNy71a9zb5yepRqEjqT0Dg

Receipt (leaf) and inclusion proof

t=1790520628;kid=ed25519-6bf5ad331bef;raw=sha256:18f5a4464255ae4d22f2833c677babe50147695f346394990657af3cd27bf29b;sanitized=sha256:84e21d1c5abb7fe03579b041467c86637a8ca6d9d7fdeea7d84d851bdf5a510b;status=purged;sig=ed25519:wjLEGbFzLoS9miJ0irf5wL6X2rnMUJM188O-tcWkGDz9sCD4aZt0UN4c4ScQhrIIYNy71a9zb5yepRqEjqT0Dg

f61ab153a0d4a5631537a0535117f3d420e5be7b0cc311a994cdcc941031629c
2337d27b25d50714b3f623c04f4a781d428b0f37fd1e7c85ae4a5a8fdbaba5a5
5163b7bf735de3c3c0eb6bd52ff083189551c0d8956ae2d78b88fe49e8da9d7a

Signed tree head

t=1790520628;kid=ed25519-6bf5ad331bef;root=sha256:1a761ed115158ee5bb3a9afdb299be262e1c3ace16ed95d519921f85588646fa;tree_size=5;sig=ed25519:ZKOQlrEFhUG0eXZf_JhRYUjwXrNsACW7Cwz9S6VdV_Oq9KvFEnf6ih7bsH1g2k_NT1T6RlZCTGHcFKO0LbEtCw

Attestation signature verifiesChecking...
Signed tree head signature verifiesChecking...
Receipt included in the signed tree headChecking...

Sample is intact

The inclusion check calls verifyReceiptInSignedHead, which takes the root and tree size only from a verified signed tree head, never from this page - never a caller-supplied root or size.

Subprocessors, DPA and status

Repeated from the security page, sourced the same way: only what the repository already states. Nothing here is invented for this page.

Subprocessors

The full, sourced table is on the security page. Only the LLM providers receive text at all, and what they receive is masked.

Read the full security page

Data processing agreement

A DPA template is available for counsel review on request, offered after legal review, not before.

Read the full security page

Status

No status page URL is configured in this build.

Source: docs/compliance/subprocessor-list.md, docs/legal/dpa-template.md, docs/ops/status-page.md