Our security model is designed for transparency, not obscurity. We explain exactly how our chain-of-custody works, what our hash structure looks like, and what we do and do not claim about our verification process.
What we do not claim
We do not claim blockchain verification, decentralized storage, or zero-knowledge proofs. Our certificates are signed and hash-chained using standard cryptographic primitives (SHA-256, ECDSA). Our verification infrastructure runs on our own servers. We believe this is the right level of assurance for physical asset disposition, and we are transparent about the trust model rather than hiding behind buzzwords.
Security practices
Hash-chained custody events
Every custody event (pickup, transport, intake, processing, certification) generates a SHA-256 hash that includes the previous event's hash as input. This creates a tamper-evident chain: modify any event and all subsequent hashes become invalid. The chain is verified automatically when a certificate is checked.
Tamper-evident certificates
Certificates are signed with our facility key and include the full hash chain. The signature covers the certificate ID, event chain, evidence manifest, and issuance metadata. Altering any field after issuance invalidates the signature, which is checked on every verification.
Independent verification
Anyone with a certificate ID or QR code can verify a certificate at verify.proofcycle.com. Verification checks: (1) the certificate exists in our registry, (2) the hash chain is intact, (3) the signature matches our public key, (4) custody event counts match, and (5) evidence files are linked.
Operator accountability
Every custody event records the operator ID and name. All operators are background-checked employees, not contractors. Photo evidence is timestamped and geotagged at our facility. Witness attestations are recorded directly on the certificate when a customer representative is present.
Hash structure
Simplified view of our chain structure.
Trust model
Our system requires you to trust that SVCM honestly records custody events and issues certificates. The hash chain and signature guarantee that certificates cannot be altered after issuance without detection, but they do not independently verify that the physical events occurred. That assurance comes from photo evidence, weight tickets, operator identity, and the optional witness attestation.
We believe this is the honest framing. Our certificates prove that we committed to a specific sequence of events and locked that commitment with cryptographic evidence. If any event is later disputed, the hash chain provides an unforgeable record of what we attested to and when.