How NumProof signs receipts, handles data, and works with security researchers. Every signed bundle is verifiable offline without our private key.
Audit, diff, and covenant bundles are signed with an EIP-191 personal-message signature produced by a fixed NumProof signer address. The signature commits to the bundle contents, so any later tampering invalidates it.
A signed bundle carries everything needed to re-check it: the rows, the computed checks, and the signature. Anyone holding a bundle can recover the signer address and confirm integrity without calling NumProof and without our private key. Trust does not depend on us staying online.
The signer key is held in the service's secrets layer and is never exposed to clients. [Key-rotation policy placeholder — rotation cadence, overlap window for accepting prior signer addresses, and the published list of valid addresses to be finalized.] Previously issued receipts remain verifiable against the signer address in force when they were issued.
Traffic is served over HTTPS. We collect the minimum needed to run the service; internal lookup identifiers — including API keys — are stored as sha256 hashes rather than plaintext. Webhook callbacks are restricted to HTTPS public targets, with private, loopback, link-local, and metadata destinations rejected before billing. Full detail is in the Privacy Policy.
If you believe you have found a security vulnerability, please report it privately to security@numproof.com before disclosing it publicly. Include enough detail to reproduce the issue. We will acknowledge your report, keep you updated on remediation, and credit you if you wish.
Please give us a reasonable window to remediate before any public disclosure, and avoid privacy violations, data destruction, or service degradation while testing.
A machine-readable contact is published at /.well-known/security.txt.