Security & trust
Our security model has one guiding rule: wherever possible, every claim should be verifiable at the source, by anyone, at any time. Here is how the platform is actually built.
Product batches are anchored as Merkle roots on Base L2 (a public Ethereum layer-2). The proof endpoint below is public and unauthenticated: anyone can fetch a product's Merkle proof, recompute the hashes and compare the root against the on-chain transaction on basescan.org. No account, no permission, no SealTrust involvement.
GET https://api.sealtrust.io/verify/merkle/{identifier}
Brand dashboard
Every NFC verification streams in live. Clone detection only alerts on anomalies, built for hundreds of thousands of products.
At scale, your team never sees the raw stream: aggregated dashboards and triaged alerts, on anomalies only.
Illustrative values
Each protected item carries an NXP NTAG 424 DNA chip. Its keys are written at the factory, are never exposed and cannot be read back off the tag. On every tap the chip generates a fresh, single-use code (SDM) that our API decrypts and validates server-side. A captured code cannot be replayed, and without the keys an attacker cannot produce a valid one. Authentication is cryptographic, not declarative.
The private keys that sign on-chain operations and the master keys that protect NFC tag secrets live in a managed cloud KMS. Signing happens inside the KMS; the raw key material is never present in application code, containers or repositories.
Certificates and product records are hashed into Merkle trees whose roots are anchored on Base L2 (chain id 8453). Because the anchor is public, integrity is verifiable by any third party (a customer, an auditor, a marketplace) without asking us and without trusting our database.
Changing the owner of a product is a sensitive operation, so it requires explicit confirmation with a one-time code (OTP or authenticator TOTP). A stolen password or hijacked session is not enough to move a product, and every transfer is recorded in the item's verifiable history.
Every scan feeds a rule-based trust engine and an ML pipeline trained on labeled scan data. Geo-impossibility (the same identity in two distant places at once), scan counters rolling backwards, replayed codes and multi-wallet patterns are flagged automatically and folded into a per-product trust score that brands monitor from their dashboard.
The most critical on-chain operations sit behind a Gnosis Safe multi-signature wallet: a quorum of authorised signers has to approve before anything executes, and every approval is recorded on-chain. No lone key can mint or burn on its own.
Data-subject rights are working software, not a policy paragraph: data export (Article 15) and erasure (Article 17) are implemented as dedicated API routes. IP addresses in scan logs are anonymised after 30 days, and retention is bounded per data category.
Production runs on European infrastructure, keeping product and consumer records under EU jurisdiction, which matters both for your compliance posture and for your customers' rights.
Security questions specific to your deployment? Talk directly to the team that built this.
Contact us