Built so you do not have to trust us.
The architecture removes Rox from the trust equation on purpose. This page lays out each layer: what we can see, what we can sign, what we can change, and why the honest answer to all three is "almost nothing".
Six guarantees, one design.
Each guarantee is structural, not contractual. They hold because of how the system is built, not because Rox promises to behave.
Your documents never leave you
Hashing happens inside your own systems. Only a salted SHA-256 digest reaches Rox Register, never the document, never its contents. There is nothing readable to leak, subpoena or breach on our side.
Salted digests
Every record is fingerprinted with a unique random salt, so the digest cannot be guessed or dictionary-matched, even for short, structured or predictable documents. You hold the salt, you decide who can verify.
Merkle batching, RFC 6962
Digests are combined into RFC 6962 Merkle trees, the same construction used by Certificate Transparency. Every record carries its own inclusion proof, independent of every other record in the tree.
3-of-5 MPC-node signing
Anchors are signed by a fleet of MPC nodes. The signing key exists only as distributed shares across five isolated nodes, and any three must cooperate to sign. No single machine, and no single operator, can forge an anchor.
A chain Rox does not control
Records anchor on RoxChain, whose validators operate independently of Rox. Once a record is anchored, nobody can rewrite it, not a customer, not an attacker, and not Rox itself.
Verify without trusting Rox
Verification recomputes the fingerprint and checks it against the chain itself. Anyone can do it, with no Rox account and no permission from us. The proof never depends on taking Rox's word for anything.
What would an attacker have to do?
Walk each attack and the structural property that blocks it. None of the defenses is "Rox notices and intervenes", they hold even if Rox is the attacker.
The signing key is never whole. Anywhere.
A conventional signing service has a key in one place: one HSM, one process, one thing to steal. Rox Register's anchor key is generated as five shares on five isolated MPC nodes and is never assembled, not even during signing.
Signing is a multi-party computation: any three nodes cooperate to produce a valid Ed25519 signature, while two nodes can fail, be compromised, or go offline without stopping the service or endangering the key.
the whole key never exists
Questions your security team will ask anyway?
Talk to us and we will walk your reviewers through the architecture, or start from the pipeline itself.