Everything, written out.

A digital witness is a record on a chain that says: this fingerprint existed at this time, and these keys signed it. The fingerprint is the SHA-256 of your content, 64 hexadecimal characters computed inside your own system or browser. The content itself never leaves you. The chain is Witnium's Hyperledger Besu network, kept by independent validators in the EU, with a new block every ten seconds.

Each organization has its own on-chain WitnessRegistry contract (version 5). A witness on it carries the following fields, all public, all readable by anyone through the public chain API.

witnessId

A 32-byte identifier derived by the contract when the witness is written.

dataId

The SHA-256 of the witnessed content.

timestamp · blockNumber

When the chain witnessed it: the block's time and height.

signers[]

Every Ed25519 public key that signed, with its signature. Several signers can be required before a witness is finalized.

previousWitnessId

An optional link to an earlier witness, forming a verifiable timeline. A "strict series" contract enforces a single linear chain.

userTimestamp

An optional event time you assert yourself, for records of events that happened earlier than now (old EXIF, migrated documents). The chain time is always recorded separately.

metadataCommitment

An optional 32-byte commitment to metadata you keep off-chain. Verified by recomputing the hash of the original metadata.

drandRound · tlockCiphertext

Optional time-lock: the content is stored encrypted on the chain and can only be decrypted after a chosen date (drand quicknet, AGE encryption). The one case where content travels, and then only ciphertext.

revokedAt · revokedReason

Revocation never deletes a witness. It appends a signed, immutable marker with a hash of the reason, visible to everyone.

Three steps, the same whether they come from the dashboard, the MCP server, the REST API or the SDK: propose, sign, finalize.

1 · Propose

Your system sends the dataId and the required signers. One credit is reserved. The service returns an intent and the exact bytes to sign. A scope (the hash of a key you choose, such as a date or a project id) makes the call idempotent: a scope holds at most one witness per dataId, ever, and a repeat returns the existing witness and charges nothing.

2 · Sign

Every required signer signs the canonical intent with its Ed25519 key. With Witnium-managed keys this happens in our key vault on your behalf; with keys you hold it happens in your own systems.

3 · Finalize

The witness is written to the chain. The call waits for the block, typically 10 to 15 seconds, and returns the witnessId, the transaction hash, the block number and the chain time. The reserved credit is committed. A failed or abandoned attempt releases it.

Limits that exist as resource bounds, not business rules: 120 proposals per minute per caller, 20 signatures per minute per user, 8 KiB per signed payload, 4 KB per time-lock ciphertext. An organization can pause all witnessing on its contract at once; reads keep working.

A witness that could only be checked by asking Witnium would be a promise. So every route below works without trusting us, and three of them work without contacting us at all.

Public witness page

Every witness has a public page and a QR code. It reads directly from the public chain API, shows the fingerprint, the block, the time, the signers and any revocation, and needs no login.

Own computer

Recompute the fingerprint with the tools already on the machine: shasum -a 256 on macOS, sha256sum on Linux, Get-FileHash on Windows. Compare with the witness. Same: verified. Different: changed.

Verification pack

A self-contained file exported for any witness. The open verifier @witnium/verify (npm, MIT) checks it offline: it makes no call to Witnium, needs no Besu node, and reads the public anchor through an Ethereum RPC endpoint you choose. Verdicts: verified, invalid, inconclusive. The trust configuration (issuer keys, genesis, contract code pins, anchor contracts) is published at witniumchain.com/.well-known/witnium-trust.json and should be obtained out of band, never from a pack.

Evidence binder

A PDF of the same facts for the people in the room: lawyers, adjusters, boards.

Through MCP

An AI assistant hashes the content locally, finds the witness whose fingerprint matches and fetches the verification pack.

What a verified result rests on: an honest two-thirds of the chain's validators at the evidence height; Witnium's anchoring process recording validator-set transitions truthfully, which anyone holding the chain can audit afterwards; the Ethereum RPC you chose; your trust configuration; and custody of the signing and owner keys. Nothing else.

What verification does not establish: authorship, legal ownership, intent. It establishes that this content existed, unchanged, at this time, signed by these keys. The rest remains for legal assessment.

All signing uses Ed25519. You choose who holds the keys.

Witnium-managed (default)

Your signing key is created in Witnium's key vault and added to your contract on your first witness. The vault signs on your behalf; the private key is non-exportable and never reaches the application servers. Members, API keys and connected AI assistants each get their own key, which an admin can revoke at any time.

Keys you hold

Your own systems sign with keys you generate. Witnium adds the public key to your contract and never sees the private key.

Self-custody

You deploy the contract with an owner key generated on your side and keep the owner-key file. Witnium receives only public keys. Members without the owner file request their key to be added and an admin approves with the owner key.

Owner operations

Adding and revoking keys, pausing and resuming are owner-signed with a monotonic nonce, and every one is listed as contract activity.

MCP server

Endpoint https://mcp.witniumchain.com/mcp. Sign-in is OAuth in the browser; there is no token to copy. Tested with Claude (Settings → Connectors → Add custom connector), ChatGPT and Grok; other clients with MCP sign-in use the same address. Seven tools: create_witness (optionally time-locked; a retry in the same scope never makes a second witness), verify_witness, find_witnesses, list_witnesses, get_witness, reveal_witness, get_verification_pack. OAuth scopes: witnesses:read, witnesses:write, sign:write, delegated-keys:write, offline_access. Writes need an active signing key; reads work without one.

REST API

Plain HTTPS and JSON, described by OpenAPI. Writes, keys and sign-in at https://accounts.witnium.com; public reads at https://api.witniumchain.com. Writes authenticate with an organization API key (wcak_…, for servers, each with its own signing key on the contract) or an OAuth 2.1 access token (PKCE, dynamic client registration, no client secret, for apps acting for a person). Four calls create a witness: The full documentation, the OpenAPI specifications and the MCP set-up guide are in the dashboard once you are signed in.

OpenAPI: api.witniumchain.com/openapi.json · accounts.witnium.com/openapi.json

POST /v5/contracts/{contract}/witnesses/propose        # dataId + requiredSigners → intentId, payloadToSign
POST /v1/sign                                           # sign payloadToSign with your key → signature
POST /v5/contracts/{contract}/witnesses/{intent}/sign   # submit the signature
POST /v5/contracts/{contract}/witnesses/{intent}/finalize   # written on chain → witnessId, block
GET  https://api.witniumchain.com/v5/contracts/{contract}/witnesses/{witnessId}   # public, no token

TypeScript SDK

@witnium/witniumchain on npm, MIT. One typed client for both services, for browsers and Node; the same SDK the dashboard runs on. WitniumchainClient for end users with OAuth, WitniumchainApiKeyClient for servers. Methods include proposeWitnessV5, sign, signWitnessV5, finalizeWitnessV5, getWitnessV5. Every non-2xx response throws a typed error with status, label and message.

Dashboard

Run a witness without code: paste text or pick a file up to 25 MB, hashed in the browser. Browse every witness on your contract, open its public page, download its evidence binder, revoke it. Manage keys, API keys, connected apps, team and billing.

Chain

Hyperledger Besu, QBFT consensus, chain id 2360, ten-second block period, validators in the EU. In production since 2018.

Contracts

One WitnessRegistry per organization, version 5 today; earlier versions remain verifiable and their code pins are listed in the trust configuration.

Anchoring

The chain's state is periodically anchored to a public Ethereum network, so a verification pack can prove that a witness was committed no later than a given time without trusting Witnium's own chain alone.

What we store

Fingerprints, times, signatures and public keys. No content, with the single exception of time-locked witnesses, which carry ciphertext until their unlock date.

Sign-in

A passkey (Touch ID, Face ID, Windows Hello or a security key), or a password of at least twelve characters checked against known breaches plus an authenticator app. A password alone never signs in.

Recovery

Ten single-use recovery codes. Account recovery by email runs with a waiting period during which the account and its admins are notified; a recovery code skips the wait.

Sensitive changes

Adding keys, creating API keys and resuming witnessing require a fresh step-up within five minutes. Pausing is immediate, because it protects.

Team

Two roles: organization admins manage team and billing; members witness and manage their own keys. The owner cannot be demoted, suspended or removed. Removing a member revokes their keys.

Connected apps

Every AI assistant or application signed in with OAuth is listed, with its own key, and can be disconnected at once.

One witness costs one credit. A credit is reserved when a witness is proposed and committed when it is finalized; a failed attempt releases it. Revoking a witness costs one credit. The ledger in the dashboard is the source of truth.

Yearly billing saves 20%. A month's allowance is added to your balance and rolls over while the subscription is active. Top-up packs for spikes, which never expire: Boost 10k €149, Boost 50k €549, Boost 250k €1,999. Prices exclude VAT. Billing runs through Stripe, with invoices and payment methods in the customer portal.

No technology makes anyone compliant. The rules say what to record. A witness makes the record hold when it is questioned.

EU AI Act, Article 50

In force from August 2026: tell people when they interact with AI and mark generated content. A witness proves what was shown, and when.

EU AI Act, Annex III and Article 12

From 2 December 2027, high-risk systems (recruitment, credit, insurance pricing, public benefits, justice, among others) must log events automatically for the system's lifetime. A witness makes those logs provable to a third party.

EU AI Act, Annex I

From August 2028, AI inside regulated products such as medical devices follows the product rules, with the same logging duty.

DORA

Financial entities and their ICT providers must produce incident timelines that hold up to the supervisor.

NIS2

Essential and important entities must document incidents and measures in a way auditors can rely on.

GDPR, Article 22

Automated decisions about people come with a right to an explanation that matches what the system actually did.

Dates and scope are stated as the regulations read today and should be confirmed by your counsel for your case.