Security

Security practices

Effective 5 November 2026. This page states what Chain Of Title LLC actually does, checked against the code and the operating record. A change to these practices changes this date.

The public register is rendered from a read-only copy of the archive; capture runs in separate processes on separate services, so nothing a reader can reach writes to the record. Nothing public depends on any personal machine. Private operational endpoints require authentication and do not disclose their existence to unauthenticated callers.

Every launch document and artwork is hashed (SHA-256) at capture, and the record carries the hash, so any later copy can be checked against what was captured. Data moved to long-term object storage carries a checksum per batch. Corrections to the published record are made in public on the corrections page, never silently.

The privacy policy enumerates the little personal data this service keeps. Beyond it: card details never touch our systems (Stripe holds them); API keys are stored as a hash plus a prefix, so the secret cannot be recovered from what we hold; third-party credentials we operate with are scoped to the least access that does the job, held as service configuration, never in the repository.

Every change ships from version control. An automated gate compiles the code and runs the full test suite on every push; a pre-deploy gate additionally refuses any deploy that would shrink the published archive. Production deploys are made by a person, on a named commit, verified against production before and after, and recorded with their time and outcome in the operating log.

Independent watchdogs inside the service measure capture, archive freshness and serving agreement, and page the operator when a measurement fails. A separate check asks the public site what a stranger would ask, every fifteen minutes, from infrastructure we do not operate, so the alarms do not share the fate of the thing they watch.

Chain Of Title LLC does not yet carry a SOC 2 attestation. The controls above are practiced and their records kept; security questionnaires are answered on request at hello@chainoftitle.org, with evidence.

Write to hello@chainoftitle.org with what you found and how to reproduce it. We will acknowledge it, tell you what we did, and not pursue anyone who reports in good faith.