One record substrate under every app
What makes a record from these apps checkable, one line each.
Records are hash-linked, so a removed or reordered entry shows.
What the register says
Sealed records written from 24 September 2026, 11:30 NZST are hash-linked, so a deleted or reordered entry in the middle of a history can be detected.
Limits and dates for each: EST-12.
Time stamps come from European authorities; the daily estate root carries two.
What the register says
Time stamps from outside time-stamping authorities under RFC 3161 are in use: Certum (Poland) stamps records, and the Portuguese state's Cartão de Cidadão authority stamps the estate root. The published estate-root index shows both stamps on every root from 4 October to 8 November 2026 (36 of 36).
Per-record time stamps come from Certum (Poland), a non-qualified service; the daily estate root also carries a stamp from the Portuguese state's Cartão de Cidadão authority (EST-10).
The Gateway checker holds four authorities’ keys, Portugal’s among them.
What the register says
The keys of four European time-stamping authorities are fixed inside the checking program: Certum (Poland), BOSA (Belgium), CESNET (Czechia) and the Portuguese state's Cartão de Cidadão authority. It verifies a stamp from any of them.
Limits and dates for each: GTW-08.
Each checking program is published with its SHA-256.
What the register says
Each offline checking program is published at mysovereignty.digital/downloads/ with its SHA-256, so a reader can confirm that the file they run is the file MDSL published.
A decision record can be exported with its approvals, receipt and events, and an offline checker (Node 20, no network, no product installed) verifies the export against a bundle of public keys.
A second signature, ML-DSA-65, on four kinds of record, switched on per account.
What the register says
A second signature using ML-DSA-65 (NIST FIPS 204) is added to Provenance™ seals, Governance API receipts, Email Decision Record™ receipts and proof-chain compaction summaries after the classical signature, so a record carries both; the downloadable verifier checks it.
Limits and dates for each: EST-37.
Signing keys sit on a separate host; a 2-of-3 split-key scheme is built.
What the register says
Signing keys sit on a separate signing host, outside the process that writes records, for every active Village™; a 2-of-3 split-key scheme (FROST) is built and deployed with no tenant on it.
Limits and dates for each: EST-16.
Where an EU-hosted Village has switched it on, one hash a day is written to Midnight mainnet.
What the register says
One value a day, the hash of the signed daily estate root, is written to an insert-once contract on Midnight mainnet, where a Village hosted in the EU has switched daily anchoring on; only that hash leaves MDSL infrastructure.
A daily hash of the estate root, which can include Governance API and Conduct Record™ receipts, is anchored on the Midnight network; the business records themselves stay on MDSL infrastructure in New Zealand and the EU.
Records stay in New Zealand and France; no US-owned provider holds them.
Every signing key is MDSL’s today. A sealed record shows what was signed and when, not that its content was true.