Verifiable artefacts

This page is the artefact it claims to produce.

Sovereign asserts that every operational instrument is signed and timestamped. The marketing surface holds itself to the same standard. Below are the cryptographic anchors for this page and for the Foundational Charter that governs every claim it makes.

About this page

The HTML at sovereign.herbstgroup.io is hashed with SHA-256 at deploy time, and the hash is anchored to the FreeTSA public timestamp authority. The hash, the anchor serial, the anchor file, and the deploy date are pinned below. The anchor is the same `.tsr` bytes that FreeTSA returned, stored at the link below; verify it offline against the page bytes you downloaded.

To verify the page you downloaded matches the anchor:

# Compute the SHA-256 of the page bytes you downloaded
shasum -a 256 index.html

# Verify the FreeTSA timestamp against your local copy
openssl ts -verify -in verify/index.tsr -data index.html \
  -CAfile <(curl -sS https://freetsa.org/files/cacert.pem) \
  -untrusted <(curl -sS https://freetsa.org/files/tsa.crt)

About the Foundational Charter

The Charter is the source of truth for every claim Sovereign makes. It was signed via DocuSign by the Chief Executive Officer. The envelope details below are sufficient to verify the signing event independently against the DocuSign Audit Events JSON.

About the audit feed

The live audit feed visible on the home page is illustrative. It demonstrates the cadence of the production audit log: a line per minute, anchored to FreeTSA on a daily schedule. Hash values for the illustrative feed are derived deterministically from the deploy id pinned above, so the same deploy renders the same sequence to every visitor. Production lines, when they ship, will land at /audit and carry the actual SHA-256 of each event together with the FreeTSA serial of the day's anchor.

Why this matters

Marketing pages typically claim a security posture and ask the visitor to take it on trust. Sovereign holds itself to a stronger standard. The page you are reading now, and the Charter that governs it, both carry verifiable artefacts. If a future version of this page makes a claim that conflicts with an earlier version, the cryptographic anchors above will reveal which version preceded which, and the Charter envelope will reveal whether the change was authorised. We expect this to be invisible to most visitors, and load-bearing for those who need it.