Service Description
OTRUST provides four main services:
- Timestamp: Blockchain timestamping using OpenTimestamps. We create cryptographic records that data existed at a specific point in time by anchoring SHA-256 hashes to the Bitcoin blockchain.
- Proof Lab: Browser-generated age and income range proofs that hide the private input. These proofs are self-attested and are not identity credentials.
- Sign: Multi-party document signing with blockchain evidence. Signers verify document hashes and sign cryptographically, with the final signature package anchored to Bitcoin.
- Auth: Issuer-gated hosted Auth for partners. Production challenges remain disabled until a trusted credential issuer is configured.
OTRUST is free to use. No account required. No payment needed.
Acceptance of Terms
By using OTRUST services (website, API, browser extension, Sign, or CLI tool), you agree to these terms. If you do not agree, please do not use our services.
Acceptable Use
You may use OTRUST for any lawful purpose. You agree not to:
- Abuse or overload our services (rate limits apply: 10 requests/minute)
- Attempt to reverse-engineer or attack our infrastructure
- Use the service for any illegal activities
- Misrepresent the nature or capabilities of the service
- Circumvent rate limiting or other protective measures
No Account Required
OTRUST does not require account registration. The service is available to anyone. Rate limiting is applied per IP address to ensure fair usage for all.
How Timestamps Work
Submission: When you submit a hash, we create a timestamp claim and submit it to OpenTimestamps calendar servers for Bitcoin anchoring.
Confirmation: OpenTimestamps batches anchors to Bitcoin roughly every hour. Full Bitcoin confirmation can take longer; until then the anchor is pending but the receipt can still be inspected.
Verification: Completed receipts can be verified independently using any OpenTimestamps-compatible client. You do not need to trust OTRUST for verification.
How Sign Works
Document Handling: You can choose between temporary upload (encrypted, auto-deleted within 1-12 hours) or local-hash mode where you share the document directly with signers.
Signing Process: Each party receives a unique link to verify the document hash and sign cryptographically. Signatures are collected and the final package is anchored to Bitcoin.
Data Retention: For temporary uploads, documents are encrypted at rest and automatically purged. Signature records (hashes and metadata) are permanent.
Legal note: OTRUST Sign provides cryptographic evidence of signature intent. Signatures are Ed25519 attestations anchored to Bitcoin, showing that parties reviewed and acknowledged a document hash at a specific time. Legal standing varies by jurisdiction and context.
How ID Works
Range proofs: The active Proof Lab generates age and income range proofs in your browser. The private value is not included in the publish request.
Stored proof data: If publishing is available, the service stores the proof, public signals, commitment, and server-derived verification metadata.
Identity credentials: Legacy self-attested identity registration is retired. OTRUST does not currently issue a government- or employer-verified identity credential.
Production availability: Range-proof publishing remains disabled until the public trusted-setup ceremony is complete.
Meaning: Verifiers can check consistency with the committed private value. They cannot infer that the value was checked by a trusted issuer.
How Auth Works
Challenges: Partners create short-lived authentication challenges through the API with a registered redirect URI and state parameter.
Hosted flow: Once enabled, users present a current trusted issuer-bound credential on otrust.eu. Partner branding is limited to approved visual elements with visible OTRUST disclosure.
Callbacks: Your server must verify the returned token, challenge binding, state, and expiry before establishing a session.
Data and Content
You are responsible for the content you timestamp. OTRUST does not review or moderate original content; we only receive cryptographic hashes for timestamping and verification metadata for related services.
Permanent Records: Timestamp records (hashes and metadata) are stored permanently and cannot be deleted. This is fundamental to long-term verification.
Privacy
We take privacy seriously. For full details, see our Privacy Policy.
Availability
We strive to maintain high availability but do not guarantee uninterrupted service. The service is provided "as is" without warranty of any kind.
Limitation of Liability
OTRUST is provided as a free, open-source service. To the maximum extent permitted by law:
- We are not liable for damages arising from use of the service
- We do not guarantee accuracy, completeness, or reliability of all records
- We are not responsible for losses resulting from interruption or third-party dependencies
- You use the service at your own risk
Intellectual Property
OTRUST is released under the MIT License. You may use, modify, and distribute the code according to the license terms.
The OTRUST name and logo are trademarks. Use of the service does not grant trademark rights.
Third-Party Services
OTRUST relies on external infrastructure:
- OpenTimestamps: Public calendar servers for Bitcoin anchoring
- Bitcoin network: Decentralized blockchain for immutable timestamp records
We are not responsible for the availability, operation, or policies of these third-party services.
API Usage
Our API is available for integration with other services. Rate limits apply:
- 10 requests per minute per IP (standard)
- Higher limits may be available for legitimate use cases
We reserve the right to block or limit access for abuse.
Modifications
We may modify or discontinue the service at any time. We may also update these terms; significant changes will be reflected on this page.
Governing Law
These terms are governed by the laws of Sweden and the European Union. Disputes shall be resolved in Swedish courts.
Severability
If any provision of these terms is found unenforceable, the remaining provisions remain in effect.