Encrypted with SEAL
Documents are encrypted with SEAL threshold encryption (AES-256) and stored on Walrus. The storage layer and any third party see only ciphertext.
Security & privacy
A trust posture you can hand to your CISO
Decot is built so a regulator, a counterparty and your own future audit can all verify the same facts — without seeing your contracts.
Current trust status
Where we stand today — stated plainly.
No security theatre. Here is exactly what is true right now, so procurement can evaluate Decot on facts rather than promises.
- Certifications
- Not yet formally certified against ISO 27001 or SOC 2. We say so plainly and will walk you through our controls on request.
- Data protection
- Built to GDPR principles, including support for data-deletion requests. The on-chain hash alone is non-identifying.
- Electronic signatures
- Qualified electronic signatures (QES) via DigiCert — eIDAS-aligned and validate as trusted in Adobe Acrobat.
- Encryption & storage
- SEAL threshold encryption (AES-256). Documents live on Walrus as ciphertext; the storage layer never sees plaintext.
- Network
- Audit hashes are anchored on the Sui public ledger (currently Sui testnet).
- Due diligence
- We answer security questionnaires in plain English, typically within two business days.
Prefer to skip the form? Download the one-pager (PDF) →
Our principles
How we think about your contracts.
Access is yours to control
You decide who can open each contract and with what role; access is enforced by on-chain grants. Decot does not open your contracts on its own — you manage your account and its access.
Audit is independent
A SHA-256 fingerprint of key actions is anchored on the Sui public ledger, with a full verifiable audit trail. Any party can verify the chain of events without trusting Decot.
Data deletion on request
We support data-deletion requests in line with GDPR principles. The on-chain hash alone is non-identifying.
Signatures that validate anywhere
Qualified electronic signatures (QES via DigiCert), eIDAS-aligned, that validate as trusted in Adobe Acrobat. UETA / ESIGN aligned.
How it fits together
Encryption & anchoring, end to end.
Proof, not promises
Don’t take our word for it. Check a real one.
Every contract produces an independent, verifiable audit trail — and the document itself stays encrypted. Here’s a real one: open the public record and check it yourself, without trusting Decot. What’s public is only tamper‑evident proof, never your document.
A real, independently verifiable example. Demo data, identities anonymised.
Threat model, in plain English
What lives where, and who can touch it.
Asset
Where it lives
Who can access
Retention
Asset
Contract content (PDF, DOCX, text)
Where
Encrypted blob on Walrus, decentralised storage
Who
Only parties you grant access to, by role
Retention
Retained until you request deletion
Asset
Encryption
Where
SEAL threshold encryption (AES-256)
Who
Access enforced by on-chain grants you control
Retention
Access can be revoked at any time
Asset
Audit log (hashes of key actions)
Where
Anchored on the Sui public ledger
Who
Anyone with the contract object reference
Retention
Permanent and independently verifiable
Asset
Metadata (titles, parties, dates)
Where
PostgreSQL on Decot infra, encrypted at rest
Who
Customer + Decot ops, only with explicit access grant
Retention
Deletable on request, in line with GDPR principles
Asset
Authentication identity
Where
Sign-in via Google / Microsoft / email (AWS Cognito)
Who
The user’s SSO provider at login
Retention
User controls — sign out invalidates session
Sub-processors
The full list of who touches your data.
We name every party that processes Decot data, why they’re involved, and what they can and cannot see.
- Sui FoundationPublic-ledger network — sees: ciphertext hash, public account ID. Never plaintext.
- Walrus / MystenDecentralised storage — sees: encrypted blobs. Cannot decrypt.
- CloudflareCDN + DNS for decot.io and docs.decot.io.
- Google CloudApplication hosting (API, queues, encrypted metadata).
- AWS CognitoIdentity & authentication — sees: the user’s SSO claim / login identity.
- Email (self-hosted)Transactional email — sign-in links, notifications — sent from Decot’s own mail server on decot.io. No third-party email processor.
- DigiCertQualified electronic-signature (QES) certificate authority for eIDAS-aligned signing.
- Google / MicrosoftSign-in (OpenID) issuers. Sees: the user’s SSO claim at login.
Bring your security checklist.
We answer due-diligence questionnaires in plain English. Send yours and we’ll come back inside two business days.