How TrustChain works
The person holds the data. The institutions hold the signatures. The network holds only the proof that the signatures are real.
The building blocks
An identifier you control
Every person and organisation has a decentralised identifier: a cryptographic identity only its owner controls. No company can take it away or reuse it.
Credentials that cannot be altered
A credential is a statement such as "this person holds a nursing licence", signed by the institution that issued it. Change one letter and the signature no longer matches.
A public registry of who may sign
The registry lists every accredited institution, what it may issue and its signing keys, plus every revocation. Anyone can look it up.
Private proofs
Where a yes or no is enough, the wallet proves it without revealing the data behind it.
How a credential is issued
Every institution sets its own approval chain, and TrustChain enforces it. High-stakes credentials need two approvals from different roles.
Drafted
An officer prepares the credential for a person's wallet, identified only by a pseudonymous reference.
Approved
One or two other officers approve it, in the order the template sets. Nobody approves their own draft.
Signed
The final approval signs it with the institution's key, held in secure hardware. Its fingerprint goes into the registry.
Delivered
The credential arrives in the person's wallet, and they choose to accept it.
Journeys: credentials that build on each other
A terminal credential, such as a degree, can only be signed over a complete, in-order and unrevoked chain.
- 2022EnrolmentSigned by admissions
- 2023Transcript, year 1Signed by the registrar
- 2025Transcript, final yearSigned by the registrar
- 2026DegreeSigned over the whole chain
A check in seconds
The verifier asks
A QR code or link says exactly what is needed, for example "holds a degree from an accredited university".
The person decides
Their wallet shows who is asking and what they will see. They share, or decline.
The proof is checked
The signature, the issuer's accreditation and any revocation are checked against the registry.
A receipt is kept
The verifier keeps a signed receipt of the decision, not a copy of anyone's documents.
Rules that come before code
Tiers of issuers
Institutions are accredited at a tier that reflects what they vouch for. Higher tiers need more evidence, and the highest needs two approvers.
Levels of assurance
Each credential says how strongly it was checked, from declared to journey-proven, so a verifier can set the level it accepts.
Revoke and reissue, never edit
A signed credential is never changed. A mistake is corrected by revoking it, with a reason, and issuing a new one.
Separation of duties
Whoever drafts cannot approve, and whoever manages staff accounts does not also sign.
Questions
Is TrustChain a blockchain?
TrustChain keeps an append-only ledger of signed events, such as accreditations, credential fingerprints and revocations, that anyone can inspect. It holds no personal data, so there is nothing personal to leak or to sell.
What does a verifier receive?
Only what it asked for and the person agreed to share, plus a signed receipt of the decision. Where a yes or no is enough, the wallet proves it privately and nothing else is revealed.
What happens if an institution's key is compromised?
Two TrustChain approvers revoke the key, a new one is created, and every verifier sees the change on its next check.
See it with your own credentials
We will walk your team through issuing and checking the credential you handle most.