Open Source,
Fully Verifiable.
We're not asking you to "trust us". You can verify yourself that the mobile app you use and the server that processes your data are byte-for-byte identical to the code you see on GitHub.
1. Enclave Attestation
To prove the code running on our servers has not been altered, we use Remote Attestation technology.
Step: PCR Values
When the code on GitHub is built, it produces a unique fingerprint called "PCR0". If a single character changes in the code, this fingerprint becomes entirely different.
Step: Hardware Proof
AWS Nitro hardware scans the running code and signs an "Attestation Document" with its own digital signature underneath.
How can you check it yourself?
- 1Clone our GitHub repo and build your own image via the Dockerfile.
- 2Note the PCR0 value produced by the build.
- 3Download the live Attestation Document and compare its PCR0 value with yours. If they match, the code is identical.
Binding Proof: Public Key Binding
But what if someone showed you an old document belonging to a different Enclave? This is where Public Key Binding kicks in.
The Enclave generates a new key for every session and sends it to AWS Nitro to be "sealed inside the Attestation Document".
Your phone compares the key inside the document with the binding key sent to it. If the seal doesn't match, it cuts the connection instantly.
2. Mobile Code Transparency
VerifyBlind uses a Deterministic Build infrastructure. We prove that the code of the app on your phone is byte-for-byte identical to the code in the open-source repository.
Offline Cryptographic Seal
The Android package built on GitHub is sealed with a 3072-bit transparency signature in our isolated environment before being uploaded to Google Play. If the code is tampered with, the seal is broken instantly.
Byte-for-Byte Output Comparison
You can verify the chain of trust yourself by comparing the build hashes in GitHub Action reports against the hashes of the files on your phone.
$ java -jar bundletool.jar check-transparency --mode=connected_device --package-name=com.verifyblind.mobile
A9 89 BA D4 84 4E 36 AC D2 E4 76 8C 86 B4 59 A2 87 7D F7 90...