Security
Any change is detectable. Even ours.
SIGIL doesn't ask you to trust the company that runs it. It hands out commitments it can't take back, so a change to the record, including one made by SIGIL, shows up when the record is checked.
The record, layer by layer
Eight layers, in plain language
Each layer catches something the one before it can't. Together they make the record tamper-evident: the design makes changes show, not impossible.
Layer 1
No edit, no delete
The app has no way to edit or delete a sent message. A correction is a new message, and the original stays.
Layer 2
A fingerprint for every message
Each message gets a salted fingerprint when it's sent. The salt is a random value kept with the message, so a fingerprint can't be used to guess the words.
Layer 3
A chain, in order
Each message's record includes the fingerprint of the one before it. Removing, adding or reordering a message breaks the chain at that spot.
Layer 4
Signed checkpoints
On a regular schedule, SIGIL signs one fingerprint for the whole record so far. It uses the same Merkle tree design as Certificate Transparency, the public logs that keep web certificates honest.
Layer 5
Held by others
Signed checkpoints go to both parties and a neutral custodian. Any later record must be consistent with the copies they already hold.
Layer 6
Independent time
Checkpoints are timestamped by independent timestamp authorities and anchored to the Bitcoin blockchain through OpenTimestamps. Only fingerprints are anchored, never content.
Layer 7
Write-once storage
Records are written to storage set to refuse overwrites and deletions for a fixed retention period, with a copy that can be mirrored to a neutral custodian.
Layer 8
A verifier anyone can run
An offline verifier, one file with no network, and a public check page. Neither needs SIGIL's permission to give an answer.
What each layer catches
If someone with access tried to change it
The hardest case is the one people worry about most: someone with access to SIGIL's own systems. This is what would show, and what is honestly left over.
| If someone tried to | What would show it | What's left |
|---|---|---|
| Edit a sent message | The words stop matching their fingerprint, every later checkpoint changes, and the copies both parties and the custodian hold no longer match. | Nothing, once a checkpoint is signed. Before then, each party's send receipt covers the gap. |
| Delete a message | A gap in the chain, and a receipt the sender holds with no matching entry. | Nothing. |
| Reorder messages | The chain links break where the order changed. | Nothing. |
| Backdate a message | A new message can only be added after the latest checkpoint, and independent timestamps fix when each checkpoint existed. | Timing inside one checkpoint window. Planned window: one hour. |
| Show different versions to different people | Two signed checkpoints for the same point in the record are signed proof of it, and the copies others hold won't match. | Someone has to compare. The check page does it in seconds. |
| Rebuild the whole record and re-sign it | Everything inside agrees, but the new checkpoint doesn't match the copies already held or the anchored fingerprint. | Nothing, as long as one outside copy exists. |
| Quietly stop signing checkpoints | A missing checkpoint is visible to everyone who expects one. | It can be detected, not forced. |
| Lose or damage the database | The write-once copy and the custodian's copies survive, and the checkpoints show whether a rebuilt record is identical. | Only messages not yet written through. The design writes each message before its receipt is issued. |
| Forge a message from the other parent | The other parent's own receipts contain no such message. | Who sent a message still rests on sign-in and receipts. Device signatures are a proposed feature. |
The check page lets you try three of these on a sample record and see exactly which link breaks.
Screening and privacy
Private by design, not by promise
Screening reads a draft to help the writer. It is designed so that what it reads is not kept, and what it finds is not shared.
- Unsent drafts are never stored. Screening runs in memory, and nothing about a draft that isn't sent is saved.
- Results are for the writer only. They never appear on the shared message, a receipt or a report.
- Human review before any flag counts. Automated screening, with human review before any flag is treated as more than an automated result.
- Only fingerprints leave. Anchoring sends fingerprints, never content. Content is shared only as the parties or an order direct.
- Planned: screening through a provider configured not to retain what it reads, and a plain-language notice before first use.
The honest limit
A wax seal never stopped anyone from opening a letter. It showed whether someone had.
SIGIL's promise is detection, not impossibility. It is built so that a change, by anyone, shows up when the record is checked, and so that the proof sits with people who don't have to trust SIGIL to use it.