The verifier is a promise, not a feature.

It is the one line on our marketing site we are prepared to defend with the company. If the verifier fails, we have failed. So we wrote down what it does, what it refuses to do, and exactly what it records, and we will keep this page honest.

§01What we promise

A CLEARSKY dossier is finalised only once its analyst confidence is set. At finalisation, the canonical dossier bytes are hashed with SHA-256 and signed with an ECDSA P-256 key held by the platform's dedicated signing service. The public verifier checks that signature against our published public keys.

Anyone holding a document id can run the check. No account. Free. Public. Paste the id into the verifier, or fetch the signed envelope directly from GET /v/{doc_id}/json. If you hold the PDF itself, POST /v/{doc_id}/verify re-verifies your copy's bytes against exactly what was signed.

The verifier reports one of four verdicts. There is no fifth verdict. There is no "Verified with caveats". A dossier either verifies or it does not.

§02What we refuse to do

• We will not return the dossier contents from the verifier. The verifier is not a copy of the dossier. If you want to read it, the dossier holder has to send it to you. That is the whole point.
• We will not let the verdict be configured by the customer. The verdict is what the cryptography says, not what anyone wants it to say. There is no override, no appeal to us, no commercial exception.
• We will not publish who verifies a dossier. Checking a document you were handed is between you and the document. Verification activity is never a public signal.

§03What we log

We log verification requests for audit: when a check ran, which document id was checked, and the outcome. That record exists so we can answer for the verifier's own behaviour, detect abuse, and investigate disputes about what was checked and when.

We will not pretend the log does not exist, and you should distrust any verification service that claims to keep no record at all: a verifier that cannot account for its own verdicts cannot be audited. What we do promise is the line above: the audit trail is ours to answer with, not a feed we publish, and we do not publish who verifies.

§04Openness

Our signing public keys are published at /.well-known/clearsky-verifier-keys.json, each with its fingerprint and PEM-encoded public key. The signed envelope for any document is public at GET /v/{doc_id}/json: the signature, the signing key fingerprint, and the signing time.

The mathematics is deliberately boring. SHA-256 and ECDSA P-256 are open, widely implemented standards with mature libraries in every mainstream language. With the published key set, the envelope, and your copy of the dossier bytes, you can re-run the entire check with standard tooling and never take our word for the result. The full cryptographic detail is written up in the verifier baseline, and guidance for referencing a verified dossier in your own work is at how to cite.

§05If we go away

The hosted verifier is a convenience. The proof is the signature. If you rely on a CLEARSKY dossier, archive three things alongside it on the day you receive it: the PDF, its signed envelope from GET /v/{doc_id}/json, and the published key set from the .well-known URL above.

With those three files, the check re-runs offline with open tooling and no dependency on our servers, our availability, or our cooperation. Do it the day the dossier arrives, not the day you need it.

§06Revisions

This manifesto is versioned. The current revision is v1.0 · 2026-07-15. Material changes will be recorded here with a new revision number and date. The platform has been live since 17 April 2026, and this page will only ever describe the verifier as it actually behaves.