Security

Last updated September 2026

What we do with your data, which providers handle it, and what is still in testing.

Where data lives

Signing: DocuSeal collects signatures and produces signed documents.
Storage: Nextcloud, hosted by The Good Cloud in the EU, stores documents and evidence files.
Hosting: this website and its APIs run on Vercel.
Payments: Stripe processes payments. During the pilot, x402 payments run in test mode.

What the ledger stores

The proof ledger stores hashes and metadata only: document hashes, entry hashes, sequence numbers, timestamps, signature data and anchor status. It never stores file contents or file paths.

Anyone can check an entry at /verify using the published method at /api/ledger/spec.

Key management status

Key management is in testing. The ML-DSA-65 co-signature on ledger entries is in testing, and our systems are not FIPS 140-3 validated. We will update this page as that changes. Every public key, including retired ones, is published at /api/ledger/pubkeys.

Report a vulnerability

If you find a security issue, email ops@sensebeen.com with the subject "Security report". Include what you found, how to reproduce it, and any affected URLs.

Please give us reasonable time to fix the issue before sharing it publicly, and avoid accessing other people's data or disrupting our services while testing.