Designed for compromise - not for marketing.
OSDF should make tampering, rollback, revision deletion, and unauthorized access detectable or preventable under the selected profile. We are explicit about what is guaranteed and what is not.
Four properties, built into the format
Passive by default
Documents cannot carry scripts, macros, executables, or auto-fetched content. Opening a file never runs document-supplied code.
Fail closed
Unknown mandatory extensions, failed proofs, unsafe content, and malformed packages block rendering - they never silently degrade.
Cryptographic verification
Integrity and provenance rest on standard primitives: SHA-256 digests, Ed25519 signatures, and signed Merkle roots.
Zero-trust architecture
Policy follows the data object. Access decisions consider identity, device, context, and freshness at the data layer.
The rules we don't break
A handful of protocol-level invariants define the boundary of the design. Implementations that violate them cannot carry an Assured or Government-Restricted designation.
No universal master key capable of decrypting all customer documents.
Every byte in a package belongs to a declared object, or is rejected.
Every protected document uses a random per-document encryption key.
Organization identity resolution and ledger trust are separate checks.
Update trust roots are offline, threshold-protected, and separated from web infrastructure.
Historical offline verification remains possible from embedded evidence.
Explore the security model
Found a vulnerability?
We maintain a coordinated disclosure process and publish signed advisories. Help us keep the ecosystem safe.