What Audrie never sees
Your documents never reach Audrie. Here is exactly what is stored, what is not, and what follows from that.
Audrie does not receive your documents. Not briefly, not encrypted, not held and then deleted. They do not leave your device.
This is worth stating plainly because most services that make a similar promise mean something weaker by it, usually "we receive your file and then delete it" or "we encrypt it at rest". Those are policies, and a policy can change or be broken. This is a property of how the system works: there is no point in the process where Audrie has your document, so there is nothing to leak, nothing to subpoena, and nothing for a future change of ownership to reconsider.
What is stored
| The document's fingerprint | Derived from your document. It cannot be turned back into the document, or reveal anything about what it said. |
| The signature | The result of signing, which anyone can use to check the record. |
| Signing keys | Held securely by Audrie and used only to sign. They are separate from the passkey on your own device. |
| Who signed | Account email and name, how their identity was verified, and their standing at the time. |
| Ledger details | Where to find the matching public entry. |
| Optional details you choose to add | Filename, and a public display name or role if you want one shown. |
What is never stored
- Your document, in any form. No copy, no fragment, no cached version.
- Anything that could be used to reconstruct it. A fingerprint reveals nothing about the contents of what produced it.
What follows from this
Three consequences, and the third is the one that surprises people.
A breach of Audrie does not expose your documents. There is nothing there to expose. Someone with complete access to our database could not read, reconstruct, or infer the contents of a single document.
Audrie can be used for documents you are not allowed to upload anywhere. Privileged legal material, patient records, sealed filings, board papers under embargo. If you are prohibited from sending a document to a third party, you can still authenticate it, because you are not sending it.
Verification requires the document. This is the trade-off, and it is a real one. Audrie cannot tell you what a document said, produce a copy, or recover one you have lost. To check a document, the person checking must already hold the file. Audrie compares fingerprints; it does not have an archive.
If you need a copy of a document to survive somewhere, that is a records-management job, not an authentication one. Audrie proves a document is genuine. It is not a backup.
A note on filenames and names
Filenames and identity details are not document content, and they are stored. A filename is metadata you chose to attach, and a verified name is what makes an authentication mean anything to the person reading it. Neither reveals what the document says.
If a filename itself is sensitive, leave it out. It is optional. Names and filenames are kept by Audrie and are not written to the public ledger.
Next
- Verifying a document covers what checking a document involves.
- What Audrie proves sets out what every live record lets you establish.