Registry and Verification Policy

1. Purpose

Buyer Review Pack receipt trust is checked against the applicable published issuer JWKS at https://registry.attestlayer.com/v1/jwks/issuer.jwks.json. Verification checks that the files have not changed since we issued them and that AttestLayer signed them, using our published signing keys. It does not prove that the answers are true. A package is not recorded in a public log.

2. What the Registry contains

The Registry publishes signing keys. It does not replace recalculating package hashes and validating an issuer receipt against a separately trusted issuer-key snapshot. The Registry does not contain customer names, company names, email addresses, source records, client requests, evidence index, or recoverable source content.

3. What verification confirms

Verification checks that the files have not changed since we issued them and that AttestLayer signed them, using our published signing keys. It does not prove that the answers are true.

Verification does not confirm that source records are true, complete, current, lawful, or accepted by an external client. It does not create an audit, certification, legal opinion, compliance approval, or client-acceptance guarantee.

4. Trust keys and internet access

Receipt verification succeeds only when the receipt key ID resolves to a separately trusted applicable issuer key published at https://registry.attestlayer.com/v1/jwks/issuer.jwks.json. Missing, malformed, untrusted, inconsistent, or unverifiable trust material produces a failure rather than a positive result. A package cannot establish its own trust by embedding its own key.

5. Registry availability

The shared public Registry surface publishes signing keys at registry.attestlayer.com. AttestLayer does not imply external witnessing or notarization.

6. External review

Anyone may independently inspect the verification materials and published trust keys. External witnessing and notarization are not represented as active unless the Registry expressly publishes that status.

7. Questions

Security and registry questions: security@attestlayer.com