Security & Privacy

In all cases, the private key is generated inside secure hardware and signing operations happen inside that hardware. The key material never enters application memory.

• Signing algorithm — Ed25519 (RFC 8032). Fast, constant-time, no weak-key classes.
• Document hashing — SHA-256. The document fingerprint in the signed bundle.
• Key fingerprint — SHA-256 of the public key, hex-encoded. Used as the identity pointer.
• On-chain hash — Keccak-256 (Polygon/EVM native).

Mark uses a two-level key hierarchy to limit blast radius:

• Root key — created once, stored in the most secure hardware available. Used only to authorize subkeys and publish identity updates. Never used for document signing.
• Signing subkey — authorized by the root key with a limited validity window (default: 90 days). Used for daily signing. Rotated automatically before expiry.

If a signing subkey is compromised, you revoke it using your root key. Signatures made before the compromise remain valid. The root key — your identity — is unaffected.

For YubiKey users, the root key lives on the hardware token, providing the strongest possible protection for the identity anchor.

What Mark never sees:

• Your private keys (root or subkey)
• Your documents (we only see the hash)
• Your biometric data

What Mark stores temporarily:

• Verification code mappings (expire after 30 days)
• Co-signing envelopes (encrypted at rest, deleted after completion)
• Push notification tokens (no message content)

What is public by design:

• Your service record on Polygon (public keys, trust tier, revocation list — published as on-chain event log via ServiceRecordRegistry)
• Your signed bundle proof chains on Polygon (document hashes, signer fingerprints, timestamps — published via MarkSignatureBundleRegistry)
• OpenTimestamps proofs (anchored in Bitcoin)