Verify a trust profile document

Every published BordersHub trust profile has a SHA-256 fingerprint and a BordersHub digital signature. Open a verifiable copy, or enter a fingerprint, to confirm a document is authentic, unaltered, and still current.

Printed in Part I of the document and at the foot of every page.
The .verifiable.json file from “Download verifiable copy”. It is checked and shown as the formatted document if authentic — nothing from it is stored.

A matching fingerprint proves the document is exactly the record BordersHub captured when the organization published it. It does not confirm the truth of the organization's own representations — see the legal notice in the document.

For legal and technical teams: checking a copy without BordersHub

A verifiable copy is a JSON file. Its record is the published record exactly as captured, sha256 its fingerprint, and signature BordersHub's ECDSA P-256 / SHA-256 (ES256) signature over the record's bytes, made with the organization's own signing key. These standard tools confirm all three: 

jq -j .record copy.verifiable.json > record.json
shasum -a 256 record.json                 # equals "sha256"
curl -s https://bordershub.com/records/keys/KEY_ID.pem > key.pem   # KEY_ID = signature.keyId
jq -r .signature.value copy.verifiable.json | base64 -d > record.sig
openssl dgst -sha256 -verify key.pem -signature record.sig record.json   # Verified OK
  • Public keys: each organization has its own, listed at https://bordershub.com/records/companies/{companyId}/keys (companyId is in the record). A key only vouches for its own organization's records. A key's id is the first 16 characters of openssl pkey -pubin -in key.pem -outform DER | shasum -a 256.
  • Formats (JSON Schema): trust profile record v1, verifiable copy v1.
  • Organizations with API access can fetch copies automatically: /api/v1/organizations/{companyId}/trust-profile/record.