One primitive, three surfaces
The data stays private. The assertion moves.
Each tier packages the same product decision: keep the sensitive source data with its
holder, then move a narrow, cryptographically sealed claim to the party that needs to
verify it. Choose the surface that matches the claim you need to issue.
01 · Issue
Scope the claim
Credential or encrypted envelope, limited to the needed facts.
02 · Seal
Bind the assertion
Make the issuance event auditable and resistant to tampering.
03 · Verify
Check without custody
Counterparties validate the claim without taking the source data.
Product tiers
Pick the surface where trust needs to travel.
These are concrete verify/seal tiers, not arbitrary usage bundles. Each one maps the primitive
to an existing product surface and a specific counterparty outcome.
01
Agent Identity
Credential issuance + verify
Let an AI agent prove it has the authority to act without exposing the human or organization behind it.
- Scoped agent credential issuance
- Policy-bound authority claims
- Counterparty verification surface
- No principal identity or history disclosure
Outcome: a verifier sees the right-to-act, not the person behind the agent.
Open Agent Identity →
02
Payroll
Encrypted envelope + receipt seal
Turn a payslip into an auditable receipt while the plaintext stays in the browser and out of the transport path.
- Browser-side encrypted salary envelope
- Jurisdiction-aware deduction claims
- KAIOS receipt seal with Ed25519 signing
- Browser-side signature verification flow
Outcome: payroll partners verify issuance and integrity without receiving the payslip bytes.
Open Payroll →
03
Lending
Credential voucher issue + verify
Convert encrypted financial history into a claim a lender can underwrite without taking custody of the history itself.
- Encrypted financial-history claims
- Policy-scoped creditworthiness proof
- Undercollateralized credential-voucher issue
- Counterparty verification flow
Outcome: extend credit against a verifiable credential, not a copied financial file.
Open Lending →
No arbitrary dollar tiers. The product boundary is the verified claim.
Buying + privacy FAQ
What gets verified, and what stays sealed?
Start with the product surface that matches your claim, then bring the right counterparty into the verification flow.
What does the Agent Identity tier include?
Agent Identity includes scoped credential issuance, policy-bound authority claims, and a counterparty verification surface. The principal identity and history stay undisclosed. See the Agent Identity surface.
What does the Payroll tier include?
Payroll includes browser-side encrypted salary envelopes, jurisdiction-aware claims, KAIOS receipt sealing with Ed25519 signing, and browser-side verification. See the Payroll surface.
What does the Lending tier include?
Lending includes encrypted financial-history claims, policy-scoped creditworthiness proof, credential-voucher issuance, and lender-side verification without handing over the source file. See the Lending surface.
Does the verifier receive sensitive plaintext?
No. The verifier receives the narrow disclosed claim or receipt metadata, not sensitive plaintext. Payroll bytes are encrypted before transport, while identity and lending source data remain sealed. Read the identity, payroll, and lending explanations for the relevant flow.
How do we start a partner POC?
Choose the product surface closest to your workflow, share your use case or compliance requirement and desired success criteria through the enterprise intake, then use the partner integration path for implementation details.