HOW IT WORKS
proof, not PDFs
Corsair turns compliance evidence into a signed proof anyone can verify. No portals. No trust centers. Just cryptography.
THE OLD WAY
PDFs and trust centers
Compliance is shared as static PDFs. You can read them, but you can't verify them. Every exchange relies on trust.
THE NEW WAY
Signed, verifiable proof
Corsair signs evidence as a cryptographic proof (CPOE). Anyone can verify the signature and provenance.
THE FLOW
Evidence in. Proof out.
01
Collect evidence
Run your security tools (scanners, CI checks, API exports) and export JSON output.
02
Sign a CPOE
Corsair signs the evidence as a JWT-VC with Ed25519 and records provenance.
03
Verify anywhere
Anyone can verify the CPOE with a DID:web lookup. No account needed.
THREE ACTIONS
The launch-ready surface
trust.txt
A public discovery file that points to SCITT and a catalog. Like security.txt, but for CPOEs.
Publish →TRANSPARENCY LOG
What the log looks like in practice
Every signed CPOE can be registered in an append-only log. It's the audit trail you can actually verify.