Trust that travels with the file
Create, share, verify, and protect documents using cryptographic trust, verifiable provenance, and zero-trust access control - online or fully disconnected.
Document
Passive package
Signature
Ed25519 scoped
Verification
Hash + Merkle
Policy
Zero-trust PDP
Secure Access
Short-lived lease
Verification you can measure
OSDF verifies cryptographic integrity locally, with no network or remote-service dependency - fast enough for operational and contested environments.
Local verification
0.2-0.6 ms typical, online or fully offline
Fail-closed on tamper
Every byte is declared, or the package is rejected
Headroom under sub-5s targets
Verification orders of magnitude below requirement
End-to-end cryptography
SHA-256 and Ed25519 today; AES-256-GCM envelope encryption coming soon
Research Challenge
OSDF is investigating whether portable, self-verifying evidence containers can provide scalable cryptographic provenance, fail-closed rendering, and compliance-ready access evidence without depending on a centralized repository.
Three guarantees, never collapsed into one badge
OSDF separates the concepts that legacy formats conflate - so a viewer can tell you exactly what is safe, what is verified, and what is authorized.
Containment by design
A passive package that cannot carry JavaScript, macros, executables, or auto-fetched content. A strict allowlist parser rejects undeclared bytes, traversal, and active behavior - before anything renders.
- Passive-by-default schema
- Sandboxed legacy PDF import
- Fail-closed strict parsing
Cryptographic provenance
Every revision is canonicalized, hashed, linked to its parent, and signed. Signed Merkle roots and an append-only transparency log make modification, deletion, and rollback detectable.
- Ed25519 scoped signatures
- Hash-linked revision chain
- Transparency log freshness
Zero-trust authorization
Policy travels with the data. Envelope encryption, enrolled device keys, identity-aware policy, and short-lived leases release plaintext only when the request satisfies policy - at the data layer.
- Per-document envelope keys
- Identity + device-bound leases
- Compartment-level policy
Defense Use Cases
Portable, self-verifying evidence containers for programs that need cryptographic accountability in contested, compliance-bound, and disconnected operations.
CUI document chain of custody
Track controlled unclassified information from origin through every transfer and access event.
Tamper-evident audit evidence packages
Export sealed packages that prove integrity and lineage for auditors and investigators.
Disconnected verification for contested environments
Verify documents and access decisions without network reach to a central repository.
SIEM-exportable access and integrity evidence
Emit structured access and integrity events for SIEM ingestion and continuous monitoring.
One open core. A full trust platform.
From a free PDF editor to enterprise zero-trust enforcement and transparency infrastructure - every product builds on the same verifiable format.
Zero-trust enforcement where network controls can't reach
Protection and policy travel with the data object - so a file stays tamper-evident, policy-bound, and decryptable only through an authorized access decision, even after it leaves your network.
Zero-trust at the data layer
Policy enforcement that reaches where network controls cannot - the file itself.
Standards-aligned
Built around NIST SP 800-207 zero-trust principles and validated-module crypto profiles.
Works in contested environments
Fail-closed verification and bounded offline leases for disconnected and degraded operation.
Customer-controlled keys
No universal master key. Organizations hold their own roots; we never bulk-decrypt.
# Verify a document - online or fully offline$ osdf verify contract.osdf # Inspect the declared object inventory$ osdf inspect contract.osdf --manifest # Review the revision chain and ledger proofs$ osdf inspect contract.osdf --revisionsVerifiable by anyone. No vendor lock-in.
The format, verification algorithm, schemas, and test vectors are public. A memory-safe Rust core compiles to native binaries and WebAssembly, with bindings for the languages your stack already uses.
- Rust core + WASM verifier
- JavaScript, Python, Go SDKsComing soon
- Hosted Verification & Ledger APIsComing soon
- Conformance test vectors
The future of trusted documents
Bring cryptographic verification, verifiable provenance, and zero-trust access control to every document your organization creates and receives.