Issue the record
The issuer chooses a template, recipient, evidence, criteria, and validity period. Certis assigns a public verification code and computes a SHA-256 integrity fingerprint.
Method · Public documentation
Trust needs a record.
Certis turns a private B2B attestation into a public, inspectable record with a lifecycle, provenance, integrity evidence, and — when available — an issuer signature.
W3C VC 2.0Portable credential model
ED25519Issuer-authenticated signature
JCS · RFC 8785Canonical payload
SHA-256Tamper-evident record
PUBLIC STATUSExpiration and revocation
DNS-BOUNDIssuer provenance
01 · The process
From assurance work to public proof.
An auditor, reviewer, or certifying organization remains responsible for the underlying work. Certis records who attested what, to whom, and for how long — then keeps that result verifiable over time.
Attach proof
For signing-enabled issuers, Certis creates a W3C Verifiable Credential 2.0 and adds an Ed25519 Data Integrity proof. Older or interrupted issuances may remain inspectable without a signature and are labelled accordingly.
Recipient claim
The recipient acknowledges the record using a six-digit code delivered to its designated mailbox. Pending claim remains visible as a separate trust signal.
Public verification
Anyone can inspect lifecycle, issuer domain, recipient claim, integrity, signature, criteria, and public evidence. No Certis account is required.
Expire or revoke
Validity ends automatically on the recorded date. An issuer can permanently revoke a record with a public reason. Historical dossiers remain available with their status intact.
02 · Status language
One record. Several independent checks.
Lifecycle is not the same as trust. Certis keeps expiry and revocation separate from issuer identity, recipient claim, record integrity, and digital signature.
Verified
Current lifecycle, claimed recipient, verified issuer domain, matching integrity fingerprint, and a valid issuer signature.
Presentation stateUnverified
The record exists, but at least one identity, integrity, or proof check is incomplete. The dossier explains exactly which one.
Presentation stateExpired
The validity window has ended. The record remains useful as historical evidence but is no longer current.
Lifecycle stateRevoked
The issuer has permanently withdrawn the record. The public reason is shown when one was supplied.
Lifecycle state03 · Technical verification
Trust can be recomputed.
The page is a human-readable projection. The credential, public key, status response, and integrity result provide the machine-readable evidence.
Record integrity
Certis recomputes the issuance fingerprint from the protected record fields and compares it with the stored SHA-256 value. A mismatch is reported independently of lifecycle.
Canonical payload
The proof payload removes the proof property and is canonicalized using JSON Canonicalization Scheme, RFC 8785. Deterministic bytes make independent signature verification possible.
Issuer signature
An Ed25519 signature using the eddsa-jcs-2022 cryptosuite binds the canonical credential to the issuer key identified by its public verification method.
Issuer provenance
DNS TXT verification connects the organization record to control of its stated domain. Domain verification is shown separately from cryptographic validity.
Portable endpoints
Credentials are available at /v1/credentials/{code}; issuer keys at /orgs/{slug}/keys; lifecycle and proof results at /v1/verify/{code}.
04 · Scope
The registry proves provenance, not quality.
Certis is not the auditor. It preserves and verifies the issuer's attestation without making the underlying professional judgement itself.
What the dossier can establish
- The stated issuer and recipient
- The recorded claim, criteria, dates, and evidence
- Current, expired, or revoked lifecycle
- Whether protected record data still matches its fingerprint
- Whether issuer domain, recipient claim, and signature checks passed
What remains with the issuer
- The quality and rigor of an audit or evaluation
- The truth of evidence supplied at issuance
- Professional, legal, or regulatory conclusions
- Ongoing compliance beyond the recorded validity window
- Any claim not explicitly present in the public dossier