Security
Evidence tooling only earns trust if it is honest about exactly what it proves and what it does not. Here is the precise scope of Provenrail's guarantee, how anyone can verify it independently, and how to report a vulnerability.
Once a record reaches the sink, it is sealed into an append-only, hash-chained sequence and signed. From that point on:
Altering, reordering, or deleting any record breaks the chain and the verifier reports it. A coherent rewrite of the whole chain is caught by the independent server receipt chain and the anchor.
The hash chain seals ordering on every plan. Builder and higher plans add RFC 3161 timestamps from an external authority, so the timing cannot be back-dated even by Provenrail.
The proof travels with the record. A third party recomputes every hash, signature, receipt, and anchor with an open-source tool, offline, trusting neither the agent, the sink, nor Provenrail.
On Builder and higher plans, the transparency log is cosigned by independent witnesses, so the log operator cannot show different histories to different parties without detection. On the Free plan the log is append-only and internally consistent, but not independently witnessed.
Hash-chain tamper-evidence holds on every plan, including the free tier, and never depends on a commercial license. RFC 3161 anti-backdating and independent witness cosignatures are Builder and higher, because they bring in external third parties. The core integrity is in the math, not in the subscription.
Overclaiming is how evidence tooling loses credibility. Provenrail is explicit about its limits:
Provenrail attests that what was recorded is intact, never that everything was recorded. An agent that does not call the SDK will not appear. Completeness is never attested.
The commercial tier check is a billing control, not DRM. The server is open source; the integrity guarantee never depends on it.
It makes records tamper-evident and verifiable. It does not, on its own, make you compliant, and it is not a substitute for counsel.
It proves a record was not altered after it was sealed. It cannot prove the agent's inputs to that record were honest in the first place.
The verifier is open source and runs with no account and no network call to us. Anyone you hand a record to can confirm it themselves:
pr verify bundle.json.A verifier you cannot check is just another thing to trust. Provenrail ships a frozen suite of public conformance vectors, and two independent implementations, the Python verifier (pr verify) and the in-browser JavaScript verifier, must agree on every one of them. If they ever diverged, the test suite would fail. That lockstep is what lets a counterparty pick whichever implementation they trust and still get the same verdict.
The SDKs, the verifier, and the spec are open source under MIT; the server is AGPL-3.0. You can read exactly how every check works.
If you find a security issue, please report it privately first. We will acknowledge, investigate, and keep you updated, and we will credit you if you wish once a fix ships.
We especially want to hear about anything that would let a record pass verification after being altered, or fail verification while genuinely intact. Those are the bugs that matter most for an evidence tool.
← Back to home