Open receipt formats
Download the JSON receipt, published development trust material and the standalone verifier. Inspect the record schema and preserve those files with the evidence.
Proof, not logs.
Verify. Don’t trust.
Take the receipt with you. Check its envelope, chain link, inclusion proof and signature outside the application.
Development signer means integrity under a published dev key and no independently trusted time.
Demonstration with synthetic records. Verification checks integrity under the selected trust material. It does not establish the truth of a recorded claim, the quality of a decision or the completeness of your collection.
A proof you can inspect.
This snapshot comes from the downloadable demo receipt. It is an archived local proof, not a live service health view. The receipt’s root covers the sequence range shown below.
- Receipt format
recourse-receipt-v1- Tenant
demo-tenantNot in the public path- Public log path
- The public log path is an opaque log id, derived from the tenant id by keyed HMAC. The tenant id is not in the URL and cannot be recovered from the path without the server key, so a public path names a log rather than a customer. A global root over all tenant roots is published by the log and a receipt carrying one verifies from leaf to tenant root to global root. The demonstration receipt published here was captured before that root existed, so it shows no global proof; its inclusion in a tenant root still verifies.
- Included record
- Sequence 2 of root range 1–4
- Sealed-at
- Root hash
- f38a96ec1a7d53ca9048e6e9969d2e8f53840d15ad1346c0d18555ec51f1735e
Development signer means integrity under a published dev key and no independently trusted time.
Sealed-at sits inside the signed root, so the verifier detects a change to it. It is still a time this service asserts, not independently trusted time. Read the date boundary.
The public log, with its boundary visible.
The local Worker exposes tenant roots, tiles and inclusion proofs without a producer login. They let a recipient compare a receipt with the logged proof material. They contain hashes and proof metadata, not the private decision object.
GET /v1/log/{log_id}/roots
GET /v1/log/{log_id}/roots/{root_hash}
GET /v1/log/{log_id}/proofs/{sequence}
GET /v1/global/rootsThe path names an opaque log identifier, never a customer. It is a keyed HMAC of the tenant identifier under a server key, so it is stable and is not derivable without that key. A tenant reads its own log identifier from its authenticated trust endpoint.
Use the separate Worker address configured for your preview. Download the local public-log response captured for this copy review. It contains the newer synthetic examination-pack records and uses their development key; it is separate from the archived demo receipt above. Each download preserves its own source and trust material. Neither is a live service health view.
The published global root aggregates tenant minute roots under those log identifiers, and a receipt that has reached a published period carries the walk from leaf to tenant root to global root. External witnesses and independently trusted timestamps remain Roadmap. A log without external witnesses does not establish that every observer received the same history.
Verification instructions and trust configurationIndependent by construction.
Your evidence about their agents should not live with them. Start with a receipt format that can travel and a verifier that can run without an application session.
The leave button
Download every record you hold in one click: every record and its receipt, in one file. Check the whole file with the verifier, with no account and no connection to us. Moving those records into another service is still up to you; a guided move is not built.
Open tenant tables
Tenant Iceberg tables and access through your own query engine are planned. This preview does not expose a live Iceberg namespace.
Check the boundary before relying on it.
Unaudited No independent auditor has examined this service, its controls or this preview. No SOC 2 report is offered by this preview. A future report, its scope and its availability must be established before those claims appear here.
For erasure, key access and physical copies have different boundaries. Legal hold takes precedence over key destruction. Read the demonstration’s limits before using its receipt as evidence of a broader process.