Evidence has limits
Atestan is designed to make its claims narrower, not broader. A proof system is useful only if its limits are out in the open, so they are part of the product, not a footer. Each one below binds whoever is reading, us included.
Security & limitations
Nothing here proves a person is the company’s legal representative
A liveness check can confirm that a real person’s face matches an ID document. It cannot confirm that this person is allowed to act for the company: that link is declared by the company, and nothing in this system can check that declaration. So the only word we use for it is declared, and we keep to that word everywhere. Naming the gap does not close it. This gap is the hardest part of the very problem the product exists to address.
What we never claim
A proof product that overstates itself has already lost. These are not disclaimers buried in a footer, they are part of the product, and they bind us as much as anyone reading.
“Unverifiable” is not “fraudulent”
No proof is not proof of fraud. A message from a company we do not cover is shown as not covered, amber, never an accusation.
If the sender’s own system is taken over, that is a real limit
If an attacker fully takes over the system a company seals with, Atestan can still prove the request carried a valid seal. It cannot, on its own, tell you the person running that system had been compromised. Proving who signed is not the same as proving the request was meant.
We do not make you compliant
Atestan makes a request harder to forge, easier to trace to its source, and harder to deny later. Being compliant with a regulation stays a property of your whole system, not of us, and we will not tell a regulated buyer otherwise.
We do not move your liability
No proof moves a company’s legal responsibility onto the person who receives the request, and banks keep theirs under the financial rules that apply to them. We say “proof anyone can re-check and export”, and we will not use stronger legal language until a payments lawyer has cleared it.
Not post-quantum end to end
One piece inside still uses older cryptography that a future quantum computer could break. It is written down, it is on our public register, and it is one of the questions we are putting to an outside cryptographer.
Never a step higher than we reached
The screen shows the step actually proved. When a step is not reached, it says why, as you just saw in the demonstration.
Not yet independently ratified
The engine is built, tested against independent reference implementations, and reproducible. It has not yet been ratified by an external cryptographer, and there has been no external security audit. Until both have happened, we say exactly this.