◈ Security
How data is handled,every step of the way.
Your file never leaves your device.
SHA-256 is computed in your browser. We receive the fingerprint and file details (name, size and available type) to help you identify and manage your records.
◇ The limits
Each notarization includes the filename, byte size and available file type so you can identify and manage your records in the app. These details stay off-chain alongside your record. The file contents stay on your device.
Stripe handles card and payment details when you buy credits or record capacity. Quantum Notary receives payment outcomes and the billing information needed to fulfill and reconcile the purchase.
Your IP address reaches us on every request. Cloudflare Turnstile processes browser and challenge data during sign-up to control abuse.
No third-party audit has been done: no SOC 2, ISO 27001, or PCI report has been produced for this service, and none is claimed. What you can check instead is the anchor — recompute the digest and read the transaction from Base yourself.
◇ The evidence
What you can check yourself.
◇ The escape hatch
Verify your notarization directly on Base in three steps.
“Independent” here means the checking path does not run through our API or our records. It does not mean the check floats free of everything — the full list of what it does depend on is beside this, and it is short enough to print.
Unaltered, byte for byte. Re-exporting a PDF or recompressing an image can change its bytes. If they change, the fingerprint is expected to differ. Keep the exact original.
It names the Base transaction and the position your fingerprint sits at inside it. Without the position, a reader has to search the transaction rather than look it up.
Any public explorer or RPC provider serving historical Base data will do. This is the one dependency that is nobody’s promise — ours included.
▸ Threat model
What holds, and what it does not do.
What holds
A retained file and its receipt can still be checked through suitable Base infrastructure, without our API or our database.
What it does not do
You need the file and the receipt in your own hands. Nothing in that scenario is recoverable from us.
What holds
A single bit-flip changes the SHA-256 digest, and it no longer matches what was anchored.
What it does not do
It does not say who altered it, or which copy was the original if you kept none.
What holds
Login, credential-change and administrative events are written to the audit log. Tenant data is isolated at the database layer, not just the application.
What it does not do
An audit log is a record of what happened, not a control that prevents it.
What holds
Every finalized record carries Base transaction and block references you can resolve yourself.
What it does not do
Verification reports what the selected RPC or explorer returns. Higher-stakes checks should compare independent infrastructure.
What holds
Relayer accounts hold permission to submit anchoring transactions and nothing else — they cannot read, modify or delete records.
What it does not do
It does not stop a compromised relayer submitting anchors nobody asked for. It could not alter or withdraw an anchor that already exists.
What holds
The private link expires at the time recorded for that receipt. New links last at least one year from finalization; previously issued links keep their recorded expiry. Link expiry does not delete the service record or Base transaction.
What it does not do
Anyone holding the link can open it inside that window. Keep it out of public messages, and save the receipt, proof PDF and exact original file before expiry.
▸ Subprocessors
The companies we work with.
We use service providers for hosting, payments, email and other services. The list shows what data each company receives and where it operates.
Check a record yourself.
Use a non-sensitive file for your first record, then keep the exact file and receipt. The file body stays on your device; its fingerprint becomes public. Use the receipt to compare that fingerprint with the named Base transaction slot.