Skip to content

Privacy properties

Witness is content-private, not metadata-private. Clients submit a SHA-256 hash rather than document content. The gateway therefore need not receive the document, but a hash is not automatically secret: anyone who can guess a public document or low-entropy value can calculate and compare its hash.

What Witness protects

  • The normal timestamp request carries a hash, not the document itself.
  • Clients can hash locally and verify an attestation locally.
  • The public verification configuration is separate from secret-bearing operational configuration.

What remains observable

The gateway, TLS endpoint, reverse proxy, load balancer, and their operators may observe or retain source IP address, timing and frequency, User-Agent, client version, application identifiers, and proxy logs. TLS protects traffic in transit from network observers but does not hide this metadata from the gateway or its infrastructure.

Unless WITNESS_WS_AUTH_TOKEN is configured or the route is blocked, the unauthenticated /ws/events stream immediately broadcasts the lowercase digest and reservation timestamp for each new job. This exposes hash reuse and submission timing to any reachable WebSocket client, before threshold confirmation.

Do not include filenames, content, account identifiers, or other identifying metadata in a hash submission's surrounding application unless disclosure is acceptable. Witness cannot protect content leaked through another service.

Freebird tradeoff

Optional Freebird can make request eligibility unlinkable from issuance, depending on the verifier and token flow. It does not hide transport metadata or prevent an operator from correlating IP addresses, timing, User-Agent, and application identifiers. Consuming /v1/verify records token nullifiers; non-consuming /v1/check does not prevent reuse. Freebird's privacy property is therefore not anonymity against the gateway operator.