Zero-Knowledge Privacy Policy

The SOC Mandate:

"If we don't have it, we can't lose it, and we can't sell it."

1. Local Hashing & Zero-Knowledge

We operate on a strict Zero-Knowledge model. When you use the Stamp-on-Chain Vault, your files are hashed locally in your browser using Web Workers. The original file data never leaves your machine. We do not store your documents, we do not read your documents, and we have no mechanism to intercept your content.

2. Identity & Hash Anchoring

To manage your account, we collect your Full Name, Business Name, and Email Address via AWS Cognito. We only anchor anonymous mathematical file hashes to the public blockchain; your Personally Identifiable Information (PII) is never stamped on-chain. We maintain internal records linking your account to your hash stamps. If you cancel your subscription, this mapping data is completely removed from our systems after 90 days.

3. Metadata Retention & Identification

We retain the mathematical metadata required to facilitate future verification. This includes your Merkle Roots, transaction hashes, filenames, and file sizes. We store filenames and sizes solely for identification purposes, allowing the system to identify and highlight specific assets within a batch during the verification process.

Retention Schedule:

For active subscribers, this metadata is maintained in our secure S3 Metadata Vault. For users who are no longer active subscribers, this metadata is automatically removed from our systems after 90 days.

4. Permanent User Records

The removal of metadata from our "Hot Vault" after 90 days does not invalidate your proof. Every user maintains their own permanent, independent record of all metadata (including hashes, filenames, and sizes) within their Certificate of Digital Origin (PDF). This file allows for "Cold Verification" regardless of the status of Hecla Technology Forge's servers.