Security & Hashing Explanation

1. Zero-File Storage Architecture

ProofLedger uses a strict privacy-first model designed to keep your files off our servers entirely:

• Files never leave your device. Our web pages hash them in your browser. API callers hash them in their own code and send only the hash.
• Our website and API never send the original file to ProofLedger, and ProofLedger does not store files.
• Only a one-way SHA-256 hash is generated from your file.

This means ProofLedger never has your files' contents. We do hold the file name (unless you leave it out), which appears on the public certificate, and your account details. Even if our systems were compromised, your original files would not be there.

2. SHA-256 Hashing

A SHA-256 hash is a cryptographic fingerprint of your file. It is:

• One-way — it cannot be reversed back into the original file.
• Collision resistant: no one has found two different files with the same SHA-256 hash, and a tiny change in a file produces a completely different hash.
• Deterministic — the same file always produces the same hash.

This allows anyone, including courts and investigators, to check if a given file matches the hash recorded on the blockchain without ever storing or exposing the original file in ProofLedger.

3. Blockchain Anchoring

ProofLedger anchors your hash on the Polygon blockchain, in its own public transaction, so anyone can check it.

Polygon

• Fast, reliable, and extremely low cost.
• Ideal for routine timestamping and high-volume use.
• Public, verifiable, and tamper-evident.

Your hash becomes part of a public ledger. Once the transaction is final, changing it would mean rewriting the public Polygon chain, which ProofLedger cannot do. This is what underpins the integrity of your ProofLedger certificate.

4. What a Certificate Shows

A ProofLedger certificate includes:

• Your SHA-256 hash.
• The timestamp of submission.
• The Polygon blockchain transaction ID.
• The Polygon transaction details you need to check the anchor yourself.
• A platform integrity signature from ProofLedger; this is not a legal document signature.

Third parties, including courts and investigators, can independently verify that:

• The hash matches the original file you present.
• The timestamp is consistent with when it was written to the blockchain.
• The Polygon transaction exists and contains the same hash.

5. Security Controls

Beyond the zero-file storage model, ProofLedger uses layered security controls, including:

• TLS encryption for all network traffic.
• API keys are stored only as hashes. There are no passwords: sign-in is by emailed code or Google.
• Segregated services and databases.
• Least-privilege access controls for internal systems.
• Regular monitoring of anchoring operations and infrastructure health.
• Strict handling of keys and secrets, with environment-based separation.

6. Limitations

ProofLedger records a specific SHA-256 hash at a specific time and anchors that hash in a public Polygon transaction, following its documented technical procedure. ProofLedger does not determine who created a file, whether a file is lawful, accurate, authentic, or admissible, or how a certificate should be weighed by courts, agencies, or third parties.

You are responsible for ensuring you have the rights to any material you anchor and for how you present ProofLedger certificates in legal or commercial contexts.

7. Contact

For security questions, audits, or legal inquiries, contact:

ProofLedger LLC
PO Box 24
Floral City, FL 34436
support@proofledger.io