01 / SEALED RECORDS

How a record is sealed, and how you check it.

Approvals, attestations, completed tasks, sign-offs and change records are sealed when they're made. After that the only change Mandate allows is withholding a record's content, for example on an erasure request. An owner has to give a reason, it can't be undone, and the chain stays intact.

PARTWHAT IT ISWHAT A CHECK SHOWSNOTE
HEADERSigned with Ed25519 and chained to the record before itA record changed after it was sealed failsHolds no personal data
CONTENTWhat the header hashes, kept apart from itWithheld content is reported as withheldThe chain still passes
CHECKPOINTA signed head for each chain, in every exportA record removed from the end is caughtOne per chain
ANCHORThe checkpoint's hash, timestamped by DigiCert under RFC 3161History up to that time hasn't been reissued since, even by usOnly a hash is sent

02 / VERIFY

Check an export yourself.

The verifier is a plain JavaScript file with no dependencies, and it runs offline. Give it an export and Mandate's public key from a source you trust. Without a key it says UNPINNED, not VERIFIED, because anyone can make a file that agrees with itself.

  • VERIFIED, UNPINNED or FAILED, naming the record that failed
  • The timestamp authority's reply checked against the anchored hash
  • The same check on the verify page, which stores nothing you upload
Mandate's verify page: what a pass means, what it doesn't, and the command to check an export offline.
Verify records

03 / YOUR DATA

Where your records are kept.

Mandate runs on Vercel with a Neon database, both in London. Email goes through Brevo, and AI assistance through Google Gemini where your organisation keeps it switched on.

Application and databaseVercel and Neon, in London
EmailBrevo, in the EU. Message bodies aren't logged
AI assistanceGoogle Gemini. Credentials are stripped first
TimestampsDigiCert receives a hash and nothing else

04 / ACCESS

Who can get in, and what's recorded.

  • Signing inA one-time link by email, or a Google or Microsoft work account. There are no passwords.
  • Work accountsMatched on an email address only when the provider vouches for it, and after that on the provider's own fixed identifier. Signing in never creates an account.
  • OrganisationsA person can belong to more than one and acts in one at a time. Every request is checked against their membership.
  • The activity logEvery act that matters, in plain words, exportable to CSV.
  • LeaversSwitched off, not deleted. A switched-off account can't sign in by any route.

05 / LIMITS

What a pass doesn't show.

  • That the content was rightA pass shows the records weren't changed after they were sealed. Whether what was sealed was right is for the auditor to judge.
  • Records after the last anchorMandate holds the signing key. Until the next timestamp, a pass shows nobody else altered those records, not that we didn't reissue them.
  • Anything about the auditor's decisionMandate never says you conform. That's the certification body's finding.

SEE A CHECK RUN

Watch an export pass, then fail once it's been tampered with.

We'll run the verifier on an export from our demonstration organisation, and on a copy with one byte changed.

Request a walkthrough