Trust centre

Say exactly what works, where it works and what it proves.

This page separates implemented sandbox behaviour, connected-mode controls and the evidence still required before production reliance.

Implemented Connected boundary Required

IMPLEMENTED

Implemented in the sandbox

ES256-signed demo credentials and key resolution in the scoped sandbox
Selective presentation of defined claims
Action, resource, amount, jurisdiction and approval policy checks
Immediate local suspended and revoked-state handling
Hash-linked, locally tamper-evident audit records
OpenAPI 3.1 and protocol-shaped demonstration boundaries

CONNECTED

Implemented for connected mode

Tenant-scoped Supabase schema and row-level security policies
Private evidence storage boundaries
Server-side key, provider and repository ports
Role and lifecycle service boundaries
Live GLEIF entity lookup with response provenance
Rate-limit, idempotency, webhook and retention worker paths

REQUIRED

Still requires production evidence

Production issuer and authentic-source contracts
KMS or HSM key custody and rotation
Connected-environment security, recovery and load testing
Provider status-list profile and operational service levels
Pilot-specific DPA, sub-processor schedule and jurisdiction review
Any certification, qualification or assurance claim

Claims we refuse to make

Verification is powerful. Overstatement is dangerous.

Automatically creates a legally valid power of attorney

Determines legal capacity in every jurisdiction

Makes an action lawful because a credential verifies

Is an EU institution or official EU wallet

Is a QTSP, QEAA provider or EU-certified service

Turns fixtures, local tests or trial connections into production integrations

Legal boundary

WhoActs provides technical evidence of authority and policy checks. Whether that authority is legally sufficient depends on the transaction, governing documents and applicable law.

WhoActs is not a law firm and does not replace each customer’s governance, contractual or legal review. The public website has a privacy notice, website terms and DPA readiness statement. A connected pilot still requires scope-specific legal, data and assurance terms.

Inspect the record

Each public claim should have a source or a boundary.

The dated evidence register links the accountable operator, public legal notices, OpenAPI model, security reporting route and production gaps in one place.

Open the evidence register

Design-partner programme

Review the evidence with legal, security and operations together.

We will map the principal, representative, action, resource, policy and relying-party decision with your legal, security and operational stakeholders.

Apply for a scoped pilot