What Audrie never sees
Your documents never reach Audrie. Here is exactly what is stored, what is not, and what follows from that.
Audrie does not receive your documents. Not briefly, not encrypted, not held and then deleted. They do not leave your device.
This is worth stating plainly because most services that make a similar promise mean something weaker by it, usually "we receive your file and then delete it" or "we encrypt it at rest". Those are policies, and a policy can change or be broken. This is a property of how the system works: there is no point in the process where Audrie has your document, so there is nothing to leak, nothing to subpoena, and nothing for a future change of ownership to reconsider.
What is stored
| The document's fingerprint | Derived from your document. It cannot be turned back into the document, or reveal anything about what it said. |
| The signature | The mathematical result of signing. |
| The record that was signed | The fingerprint, the signing standard used, who signed, when, and the key needed to check it. |
| The public half of the signing key | Needed by anyone verifying. Public by design. |
| The private half of the signing key | Held encrypted, and only ever decrypted for the instant it takes to sign, then discarded from memory. |
| Who signed | Account email and name, how their identity was verified, and their standing at the time. |
| Ledger details | Where to find the matching public entry. |
| Optional details you choose to add | Filename, and a public display name or role if you want one shown. |
What is never stored
- Your document, in any form. No copy, no fragment, no cached version.
- Anything that could be used to reconstruct it. A fingerprint reveals nothing about the contents of what produced it.
What follows from this
Three consequences, and the third is the one that surprises people.
A breach of Audrie does not expose your documents. There is nothing there to expose. Someone with complete access to our database could not read, reconstruct, or infer the contents of a single document.
Audrie can be used for documents you are not allowed to upload anywhere. Privileged legal material, patient records, sealed filings, board papers under embargo. If you are prohibited from sending a document to a third party, you can still authenticate it, because you are not sending it.
Verification requires the document. This is the trade-off, and it is a real one. Audrie cannot tell you what a document said, produce a copy, or recover one you have lost. To check a document, the person checking must already hold the file. Audrie compares fingerprints; it does not have an archive.
If you need a copy of a document to survive somewhere, that is a records-management job, not an authentication one. Audrie proves a document is genuine. It is not a backup.
A note on filenames and names
Filenames and identity details are not document content, and they are stored. A filename is metadata you chose to attach, and a verified name is what makes an authentication mean anything to the person reading it. Neither reveals what the document says.
If a filename itself is sensitive, leave it out. It is optional.
Next
- Verifying a document covers what checking a document involves.
- What we do and don't claim sets out the boundary of Audrie's answer.