Tamper-evident documents.
Security you can check. Continuity you can rely on.
Document integrity first: tamper-evident documents with integrity receipts, daily anchoring to the XRP Ledger launching, scoped time-limited access, personal data and documents kept off the ledger, no custody of keys, money or goods - and a record you can export and verify if we are gone.
- SHA-256
- 9f2c7a0e 4d1b…c83e e41b
- Seal
- pv-seal-v2 · key id
- Sealed
- 2026-09-18 10:42:07 UTC
- Original
- v1 kept, superseded
Document integrity: every document is sealed the moment it arrives.
Today, proof is a SHA-256 fingerprint and a seal signed with Property Vault's key. These are tamper-evident documents, not "tamper-proof document storage": a changed file is detected, never hidden. Integrity anchoring runs as a rehearsal on the XRPL testnet: Merkle roots of keyed commitments are written to the test network, which can be reset, and listed on the public anchor page; mainnet anchoring is on the roadmap, subject to approvals.
Hash on upload
SHA-256 as the file lands - what makes these tamper-evident documents. Change one byte and the fingerprint changes.
Receipt issued
Hash plus timestamp, kept in the record.
Corrections are versions
A correction is a new version with its own receipt; the original is kept.
Anchored daily
Each day's keyed commitments fold into one Merkle root - one memo, nothing identifiable. Rehearsal on XRPL testnet; mainnet on the roadmap, subject to approvals. Launching
The Owner grants. The role limits. Opens are logged.
No link reads everything. Access is a scope - granted by the Owner to a role, for a period.
- Tokens are 160-bit random values, stored hashed, expiring. A database copy cannot be replayed.
- Four scopes live in pilot - owner, agent-buyer, insurer-surveyor, solicitor. Lender-valuer and loss-adjuster scopes come next.
- Scopes hide documents, not history. The timeline is always whole.
- Opens are logged by scope, day and device - never the raw IP address. A revoked token stops at once; revoking from your own record, and seeing who opened it, are launching.
XRP Ledger anchoring: the ledger will hold a timestamp. The record stays with you.
Today anchoring is a rehearsal on the XRPL testnet, and a test network can be reset, so a testnet timestamp proves nothing lasting. Anchoring to mainnet, where a public timestamp could not be rewritten by anyone, Property Vault included, is on the roadmap, subject to approvals. The ledger is used for that, and for nothing identifiable.
On the ledger
- A daily Merkle root of keyed commitments, one AccountSet memo from our anchoring account. 32 bytes, nothing identifiable. Rehearsal on XRPL testnet. Launching
- Later, a pointer token per Vault ID - a pointer to the record, never title; identifies no property. Testnet after the DPIA. Roadmap · subject to approvals
- Later, issuer registrations - bound to a professional's account, never to an asset. Roadmap · subject to approvals
Never on the ledger
- Documents - versioned object storage, hashed and receipted.
- Personal data - names, emails, account links, the open log.
- Addresses and natural keys - UPRN, title number, VRM, VIN, serial.
- Scoring - in the record, where it can be corrected.
- Legal title - the statutory register wins. A token is a pointer, never ownership.
Data-protection impact assessment Not yet complete
Required before any identifiable write, against the EDPB 2025 guidelines on blockchain: nothing reachable from the ledger may identify a property or a person. Until it is complete, only the Merkle root goes to mainnet; its summary will be published here.
Erasure and anchored hashes
On a request for erasure, the document, its receipt and every personal field are deleted. The 32-byte root left on the ledger cannot be reversed into the file or, without the receipt, linked to it.
Private by default. Shared on the Owner's terms.
A Vault is not a directory. Nobody can look up what you own, and tamper-evident documents are read only under a scope the Owner granted.
No public lookup
No search by address, registration, serial or any natural key - anywhere, including the Vault API. A Vault is reached by a granted scope or not at all.
Valuables private by default
Everything starts private. One demonstration record is public, deliberately; no real Vault is.
Opens leave a trail
Opens are logged against the scope that allowed it. Sharing is a decision you can audit.
No custody. Property Vault never holds keys, client money or physical goods.
A verification layer should have nothing to steal.
Keys
No Owner wallets, no managed keys, no signing on anyone's behalf.
Client money
No escrow, no payments, no settlement. Where a regulated partner settles in RLUSD, that partner holds the money.
Physical goods
The asset stays with its Owner or their custodian. We hold the record of the thing, never the thing.
Data export and continuity: a record that outlives the company that made it.
Provenance platforms have failed and taken their records with them - Everledger entered administration in 2023 (Rapaport, 2023). No URI we control is the only path to a record.
-
Open export schema
Every Vault exports in full - tamper-evident documents with their hashes and receipts, events, transfers - in the open schema the Vault API reads.
-
Data escrow for Organisations
When an Organisation pays for Pro, its records and export tooling go to a named escrow agent, released if Property Vault ceases trading.
-
What a holder can read if we are gone
Their exported record, with every document, its SHA-256 fingerprint and its seal - checkable against our published keys without us. Once a record's manifest has been anchored, the export also carries an inclusion proof, checkable by recomputing its path to a published root; anchoring is in rehearsal on the XRPL testnet, a network that can be reset, so mainnet anchoring (on the roadmap, subject to approvals) is what will make that check lasting.
What is in place, and what we are working towards.
Real practices only.
| Practice | Here | Status |
|---|---|---|
| Encryption in transit | TLS on every connection. | Live in pilot |
| Encryption at rest | Database and documents encrypted on production hosting. | Launching |
| Access control | Password-protected professional admin with hashed passwords and mandatory two-step sign-in for issuing, reviewing and admin roles; scope-gated reads; opens logged. | Live in pilot |
| Backups | Postgres and versioned object storage, with off-site backup of the database and every sealed document. | Launching |
| Tamper-evident documents | SHA-256 on upload, receipt, originals kept, corrections as versions. Document integrity check. | Live in pilot |
| Integrity anchoring | Integrity anchoring runs as a rehearsal on the XRPL testnet: Merkle roots of keyed commitments are written to the test network, which can be reset, and listed on the public anchor page; mainnet anchoring is on the roadmap, subject to approvals. Inclusion proofs are checkable at verify.html. | Launching |
| Passkeys | Owner passkeys (owner accounts are switched off) and the staff passkey countersignature of issued events - both need configuration before they switch on. | Launching |
| Cyber Essentials Plus | Our first certification target. Nothing is shown until it is held. | Stated target |
Entity and security disclosure: shown the day it exists. Not a day before.
Property Vault is based in Leeds, UK. Each entry appears the day it is issued - blank on purpose until then.
- Company number on incorporation
- ICO registration on registration
- Named data protection officer on appointment
- Professional indemnity policy on cover
- Cyber Essentials Plus certificate on certification
- DPIA summary on completion
Security disclosure
Found a vulnerability? Tell us first at hello@propertyvault.world. Personal-data questions: the privacy notice.
- Describe it and how to reproduce it; take no data beyond what proves it.
- We reply from the same address, and tell you when the issue is fixed. Please give us time to fix it before you publish.
Tamper-evident documents, answered.
What does tamper-evident mean for my documents?
Every file is hashed with SHA-256 the moment it is uploaded and given an integrity receipt: the hash and the time, sealed with Property Vault's key. Change one byte and the fingerprint no longer matches. Tamper-evident means a change is detected, not that a file can never be replaced; corrections are stored as new versions with the original kept.
Are my documents stored on the blockchain?
No. Documents, personal data, addresses, natural keys, scores and legal title never go on the ledger. Only a daily Merkle root of receipts, 32 bytes with nothing identifiable, is written to the ledger. Integrity anchoring runs as a rehearsal on the XRPL testnet: Merkle roots of keyed commitments are written to the test network, which can be reset, and listed on the public anchor page; mainnet anchoring is on the roadmap, subject to approvals. What is written is explained in the privacy notice.
How do I check a document has not been altered?
Run a document integrity check: your browser hashes the file locally and the seal's signature is checked against the receipt. Comparison against the XRP Ledger arrives with anchoring.
Does Property Vault hold my keys, money or goods?
No. No Owner wallets, no managed keys, no signing on anyone's behalf; no escrow, payments or settlement; the asset stays with its Owner or their custodian. Where a regulated partner settles, that partner holds the money.
Can I export my record, and what if Property Vault stopped operating?
Every Vault exports in full - documents, hashes, receipts, events and transfers - in the open schema the Vault API reads; full export is launching. Receipts are plain hashes you can check without us, and once anchoring reaches mainnet each receipt will be verifiable against the XRP Ledger. More in the Help Center.
What security certifications does Property Vault hold?
None yet. Cyber Essentials Plus is the first stated target and nothing is shown until it is held. The practices table above lists what is live in pilot and what is launching, with no claims beyond it.
Check a receipt. Ask us anything.
The inclusion-proof checker at verify.html runs in your browser against proofs from the testnet rehearsal; a record carries its proof once its manifest has been anchored, and mainnet anchoring follows the DPIA. Procurement questions: hello@propertyvault.world.