How it works

From a private document to a public, permanent proof.

This page walks the whole pipeline: what your systems compute, what leaves your infrastructure, what lands on RoxChain, and how a stranger verifies the result without ever asking Rox.

Step 1 · Seal

Only a fingerprint ever leaves the building.

Your systems compute a salted SHA-256 fingerprint of the record and send only that digest to the Rox Register API. The document itself never leaves your infrastructure.

The salt matters: every record is fingerprinted with a unique random salt, so the digest cannot be guessed or dictionary-matched, even for short, structured or predictable documents. A one-page NDA and a terabyte archive both reduce to the same size of opaque digest.

You hold the salt. Whoever you give the document and salt to can verify; nobody else can learn anything from the digest, including Rox.

contract.pdf
stays with you
+ salt · SHA-256
a3f9c1…8e21
32 bytes, opaque
POST /v1/seal
Rox Register API
digest only
nothing readable to leak, subpoena or breach on our side
Step 2 · Anchor

Batched into a Merkle tree, signed by a fleet, recorded on chain.

Digests are combined into RFC 6962 Merkle trees, the same construction used by Certificate Transparency. Every record carries its own inclusion proof, independent of every other record in the tree, one on-chain anchor covers thousands of records without linking them to each other.

RFC 6962 Merkle treeinclusion path highlighted
root
h01
h23
yours
h1
h2
h3
Your record plus two sibling hashes recompute the root. That short path is the whole proof, no other record in the batch is revealed or needed.

3-of-5 MPC-node signing

The anchor is signed by a fleet of MPC nodes. The signing key exists only as distributed shares across five isolated nodes, and any three must cooperate to sign. No single machine, and no single operator, can forge an anchor.

s1s2s3s4s5

Recorded on RoxChain

The signed anchor lands on a chain whose validators operate independently of Rox. Once committed, nobody can rewrite it, not a customer, not an attacker, and not Rox itself.

n-2n-1nimmutable from here on
Step 3 · Verify

Anyone can check. Nobody has to ask Rox.

Verification recomputes the fingerprint from the document and salt, walks the inclusion proof, and checks the result against the anchor on RoxChain. A genuine document verifies. A document changed by a single byte does not.

It is public and self-service: no Rox account, no permission from us, no API key. The proof never depends on taking Rox's word for anything, that is the entire point of the design.

no accountno trust in Roxbyte-level sensitivity
Illustrative verification
re-hash document + salt✓ match
walk Merkle inclusion proof✓ root ok
check anchor on RoxChain✓ anchored
Record is genuinesealed before dispute
same file, one byte altered✗ fails

See what this looks like in your sector.

Thirteen industries, each with a dedicated page: what gets sealed, the workflow, and the moment verification pays off.

Browse industriesTrust architecture