Skip to content

Privacy model

Implemented behavior

Witness accepts a SHA-256 hash rather than the content being timestamped. The gateway forwards and persists the attestation fields and signatures; witness nodes sign those fields. The normal API therefore does not require the document, file bytes, or a user account. Public verification configurations omit witness endpoints and bearer tokens.

Optional Freebird integration can require an anonymous admission token for new attestation jobs. Consuming mode calls Freebird /v1/verify and rejects token reuse; non-consuming mode calls /v1/check and must be paired with another replay or rate-control boundary. Freebird controls admission, not transport metadata.

By default, /ws/events is unauthenticated. The gateway immediately broadcasts the lowercase digest and reserved timestamp for each new reservation, before threshold confirmation. Operators and anyone able to reach that route can use it to observe submission timing and newly reserved hashes.

Assumptions

Hash privacy depends on the entropy of the underlying content. A public file, short phrase, or small dictionary value can be guessed and hashed by an observer. Clients are also responsible for not sending content or identifying metadata through another channel and for using HTTPS at the edge.

What operators can still observe

Witness does not hide:

  • source IP address and connection information;
  • request timing, frequency, and hash reuse patterns;
  • User-Agent, client version, and application identifiers;
  • reverse-proxy, load-balancer, gateway, and operational logs; or
  • the fact that a particular hash was submitted or later published in a batch.

An operator or infrastructure provider may correlate these signals. Freebird may make issuance eligibility unlinkable from verification under its own protocol, but it does not hide the transport connection to Witness.

Non-goals

“Content-private” is not content confidentiality, metadata anonymity, unlinkability against an operator, or protection from a compromised deployment. Witness does not provide accounts, identity proof, authorship proof, or a guarantee that a hash cannot be guessed.

TODO — maintainer review

Add a concrete data-retention and log-redaction policy, and review whether batch publication, duplicate handling, and WebSocket/metrics behavior create additional observable metadata that should be documented here.