You don’t yet know which compliance framework your enterprise customer will require.
Vitrified already does all of them.
Cryptographic attestation infrastructure for developers. Submit a hash plus structured metadata; we witness every batch root in parallel through six independent trust mechanisms and return a proof bundle that verifies cleanly with whichever standard reference tooling your auditor speaks.
What’s etched here, stays.
Integration is one SDK call
Hash locally, submit a digest plus metadata, receive a proof bundle. Same code, every language.
import { Vitrified } from "@vitrified/sdk";
const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });
// Hash the artifact locally — bytes never leave your environment.
const digest = await vitrified.hashFile("./build/release.tar.gz");
// Submit hash + structured metadata for witnessing.
const submission = await vitrified.attestations.create({
artifact: { sha256: digest },
metadata: {
schema: "slsa.provenance.v1",
predicate: { /* ... */ },
},
});
// Bundle becomes available once the batch is witnessed.
const bundle = await vitrified.attestations.waitForBundle(submission.id);
console.log(bundle.witnesses); // eidas, rfc3161, rekor, ots, evm, dsse→ proof bundle: 6 witnesses, batch root included in next window (~60s), independently verifiable offline.
Six trust mechanisms. One integration.
Every batch root is witnessed in parallel through all six. Each verifies against its own public trust infrastructure with its own reference tooling.
eIDAS qualified timestamps
Pooled QTSPs. Verifies against the EU Trust Services List with the EU DSS validator.
RFC 3161 timestamps
Pooled free public TSAs. Verifies with openssl ts -verify.
Sigstore Rekor
Public transparency log inclusion. Verifies with cosign verify or rekor-cli.
Bitcoin via OpenTimestamps
Anchored into the Bitcoin chain. Verifies with the ots client.
EVM L2 anchoring
Anchored on a public EVM rollup. Verifies with any web3 client.
DSSE envelope
Vitrified-signed envelope. Verifies with any DSSE-compliant tool.
Standards-conformant by construction
No Vitrified-branded verifier sits on the trust path. Every bundle passes the reference verifier for its mechanism.
We never see your bytes
Vitrified is hash-only by default. You hash locally; we receive the digest plus structured metadata. The bytes of your artifact never cross our wire. There is nothing for us to leak, subpoena, or lose.
Use cases
Same engine; the framing changes with the artifact.
Software supply chain
Attest releases, container images, SBOMs, and SLSA provenance. Pass cosign verify, slsa-verifier, and in-toto-verify cleanly. Drop the GitHub Action into your release workflow.
Document attestation
Prove a document or filing existed at a moment in time. eIDAS-qualified timestamp tokens for European regulatory contexts; RFC 3161 for everywhere else.
AI artifact provenance
Attest training datasets, model weights, evaluation results, and inference outputs. Multi-mechanism witnessing makes downstream provenance claims independently verifiable.
Content authenticity
C2PA-compatible bundles for media provenance and authorship attestation. Verifiable inside C2PA-aware tooling without trusting Vitrified.
Self-serve. Volume-scaled subscription.
Continuous witnessing infrastructure, billed as a subscription with tiers that scale to your stamping volume. No sales call required to get started; no per-feature unlock tiers; no surprise overage bills.
Trust documentation
Sub-processor schedule, DPA, security posture, data-portability defaults, and the wind-down plan — linked from the footer, not buried.
Read the trust docs →Open source
The SDKs, the verifier libraries, the CLI, the GitHub Action, the MCP server, and the spec all live in the open repository and ship under permissive licenses.
Browse the repo →