Security
Any change is detectable. Even ours.
You don't have to take SIGIL's word for the record. SIGIL hands out commitments it can't take back, so a change to the record, including one made by SIGIL, shows up when the record is checked against a copy held outside SIGIL.
The record, layer by layer
Eight layers, in plain language
Each layer catches something the one before it can't. Together they make the record tamper-evident: the design makes changes show, not impossible.
In the app
What anyone using SIGIL can and can't do.
- 1
No edit, no delete
The app has no way to edit or delete a sent message. A correction is a new message, and the original stays.
In SIGIL's record
How each message is fastened to the ones around it.
- 2
A fingerprint for every message
Each message gets a salted fingerprint when it's sent. The salt is a random value kept with the message, so a fingerprint can't be used to guess the words.
- 3
A chain, in order
Each message's record includes the fingerprint of the one before it. Removing, adding or reordering a message breaks the chain at that spot.
- 4
Signed checkpoints
At regular intervals, SIGIL signs one fingerprint for the whole record so far. It uses the same Merkle tree design as Certificate Transparency, the public logs that keep web certificates honest.
- 5
Write-once storage
Records are written to storage set to refuse overwrites and deletions for a fixed retention period, with a copy designed to be mirrored to a records custodian the parties or the court choose, which is planned.
Outside SIGIL
Proof that sits with people who don't have to trust SIGIL.
- 6
Held by others
Signed checkpoints go to both parties. Any later record must be consistent with the copies they already hold. Planned: a records custodian the parties or the court choose, holding a copy too.
- 7
Independent time
Checkpoints are timestamped by independent timestamp authorities and anchored to the Bitcoin blockchain through OpenTimestamps. Only fingerprints are anchored, never content.
- 8
A verifier anyone can run
Being built: an offline verifier, one file that runs with no network and without SIGIL. The public check page is a convenience that SIGIL serves. Planned: a hash-published copy of it that anyone can keep.
What each layer catches
If someone with access tried to change it
The hardest case is someone with access to SIGIL's own systems. This is what would show, and what is honestly left over. Detection depends on someone checking a copy held outside SIGIL.
| If someone tried to | What would show it | What's left |
|---|---|---|
| Edit a sent message | The words stop matching their fingerprint, every later checkpoint changes, and the copies both parties hold no longer match. | Nothing, once a checkpoint is signed and someone checks it. Before then, each party's send receipt covers the gap. |
| Delete a message | A gap in the chain, and a receipt the sender holds with no matching entry. | Nothing. |
| Reorder messages | The chain links break where the order changed. | Nothing. |
| Backdate a message | A new message can only be added after the latest checkpoint, and independent timestamps show that each checkpoint existed by a certain time. | Timing inside one checkpoint window. Planned window: one hour. |
| Show different versions to different people | Two signed checkpoints for the same point in the record are signed proof of it, and the copies others hold won't match. | Someone has to compare copies. Planned: checkpoints published to a public log, so a comparison doesn't depend on one person. |
| Rebuild the whole record and re-sign it | Everything inside agrees, but the new checkpoint doesn't match the copies already held or the anchored fingerprint. | Nothing, as long as one outside copy exists. |
| Quietly stop signing checkpoints | A missing checkpoint is visible to everyone who expects one. | It can be detected, not forced. |
| Lose or damage the database | The write-once copy and the copies the parties hold survive, and the checkpoints show whether a rebuilt record is identical. | Only messages not yet written through. The design writes each message before its receipt is issued. |
| Forge a message from the other parent | The other parent's own receipts contain no such message. | Who sent a message rests on sign-in and receipts until each message carries a signature from the sender's own device or passkey. Required before launch. |
| Change the app so it shows different words than it recorded | Partly: the send receipt each party can download and keep outside the app records the fingerprint of what was actually sent. | A real limit for any app. Receipts kept outside the app and an open verifier narrow it. They don't close it. |
| Steal or misuse SIGIL's signing key | Checkpoints others already hold stay binding, and independent timestamps show which checkpoints already existed, and by when. | False new checkpoints could be signed until the key is replaced. A rewrite of what others already hold would still show, and a forged new message would still be missing from the other parent's receipts. |
Every “Nothing” above assumes at least one copy of the checkpoints is held outside SIGIL and someone compares against it. The check page lets you try three of these on a sample record and see exactly which link breaks.
Super Intelligence (SI) screening and privacy
Every message screened by Super Intelligence.
When SI screening is on, every outgoing message is checked against the order before it's sent. Both parents turn it on together, or the court sets it. SI screening is designed so that what it reads is not kept, and what it flags is shown only to the writer.
Super Intelligence (SI) is the official U.S. term, since September 22, 2026, for what used to be called artificial intelligence. SIGIL's SI screening uses a commercially available large language model.
SI screening is automated and can be wrong. You remain responsible for what you send.
- Unsent drafts are never stored. Screening reads a draft in memory to check it, then keeps nothing about a draft that isn't sent.
- SI only with both parents' consent, or the court's order. Every draft gets SIGIL's fixed checks. SI reads drafts only when both parents agree or the court sets it; if either parent says no, both get the fixed checks only.
- SI holds; it never rewrites. SI can hold an outgoing message that may cross the order's lines before it's sent. It never writes or rewrites a message, and it never alters a message someone else sent you.
- Results are for the writer only. They never appear on the shared message, a receipt or a report.
- A flag is a prompt, not a finding. A flag is for you, the writer, to review before you send. It is never treated as a finding.
- Only fingerprints are anchored. Anchoring sends fingerprints, never content. Content is shared only as the parties or an order direct, and with the service providers that process it for SIGIL.
- Required before launch: SI screening only through a provider configured not to retain what it reads, and a plain-language notice before first use.
The honest limit
Detection, not impossibility.
That is what SIGIL is built for: a change, by anyone, shows up when the record is checked against a copy held outside SIGIL, and that copy sits with people who don't need SIGIL's permission to use it.