Where your keys, data and records live.
Key custody, network, data, retention and support, stated as current positions rather than roadmap.
- Hosting
- NoneSelf-hosted. Originary runs no verification service.
- Key custody
- YoursLocal or your KMS. Originary never holds signing keys.
- Certifications
- None claimedNo SOC 2 or ISO 27001 audit has been completed.
- Disclosure
- 5 business daysTo acknowledge a security report.
Answers your review team will ask for.
| Procurement fact | Current position |
|---|---|
| Hosting mode | Self-hosted. The software runs in your infrastructure; Originary operates no hosted verification service. Deployment options. |
| Key custody | Yours. The issuer generates and holds its Ed25519 keys locally or in your KMS. Originary never holds signing keys. Key management. |
| Data processed by Originary | None from verification, which runs in your environment. Website only: consent-gated analytics and what you send through the contact form. Privacy policy. |
| Retention | Website data is kept only as long as needed for the stated purpose and legal obligations, then deleted or anonymized. Privacy policy. |
| Subprocessors | Processors for hosting, payments, and support under contractual safeguards. Some support operations are performed by an India affiliate under SCCs and DPAs. Privacy policy. |
| Data residency | Not applicable to verification, which never leaves your environment. Website processing may occur outside your country with the safeguards described in the privacy policy. |
| Supply chain | npm packages use OIDC trusted publishing and SLSA build provenance; releases carry SSH-signed annotated tags. Supply-chain posture. |
| Certifications held | None. No SOC 2, ISO 27001, or comparable third-party audit has been completed, and none is claimed. |
| SLA and support | No SLA on the open-source protocol; support there is community-based via GitHub. Support scope and response commitments apply only where set out in a written agreement. |
| Incident process | Report to security@originary.xyz. Reports are acknowledged within 5 business days and triaged by severity. Disclosure policy, security.txt. |
| Responsible contact | security@originary.xyz for security, privacy@originary.xyz for data requests, contact@originary.xyz for everything else. |
| Evidence | Security, privacy policy, and the public repository. |
Each row states the current position, not a roadmap commitment. If your review needs something not listed here, contact us and we will answer it directly.
What composes with PEAC, and how far it goes.
Each row states what exists in the open repository at v0.16.4. A shipped adapter or mapping is code you can read and run; a written composition is a mapping with conformance vectors; an example is a runnable demonstration.
| System | Status | Evidence in the repository |
|---|---|---|
| MCP | Shipped mapping | packages/mappings/mcp packages/mcp-server examples/mcp-gateway-receipts |
| x402 | Shipped adapter | packages/adapters/x402 examples/x402-paid-resource-records |
| OpenTelemetry | Shipped adapter | packages/telemetry-otel docs/guides/telemetry-otel-correlation.md |
| A2A | Shipped mapping | packages/mappings/a2a examples/a2a-gateway-pattern |
| MPP / paymentauth | Shipped mapping | packages/mappings/paymentauth examples/mpp-payment-record |
| UCP | Shipped mapping | packages/mappings/ucp examples/ucp-webhook-express |
| ACP | Shipped mapping | packages/mappings/acp examples/acp-session-lifecycle |
| AP2 | Written composition | docs/specs/AP2-COMPOSITION.md specs/conformance/interop/ap2-open-mandate-hash |
| Stripe | Written composition | docs/interop/SIGNED-RECORDS-INTEROP-MATRIX.md integrator-kits/stripe-projects |
| Cloudflare | Example | surfaces/workers/cloudflare examples/cf-policy-x402-terms |
No partnership, certification, or endorsement is implied. These are interoperability surfaces PEAC composes with, not relationships with the organizations behind them. Product names, logos, and brands belong to their respective owners. Dated per-row detail lives in the repository's interop matrix.
How verification works.
Verifying a record
Every interaction record is a signed JSON Web Signature (JWS). The issuer signs the claims with a private key; any verifier checks the signature against the issuer's public key. Any conforming JOSE implementation can check the signature; full PEAC validation also checks the record profile and required fields.
Verification does not call Originary. In strict offline mode the key is supplied and there is no network request. In explicit-resolution mode the caller authorizes a single JWKS fetch, then validates locally. Verification also depends on trusted issuer key material and on the verifier's cache, expiry, and revocation policy.
Cryptography and keys
Ed25519 only, standardized in RFC 8032, with compact 32-byte public keys. You bring your own keys, under infrastructure you control, using an Ed25519-compatible KMS or HSM where appropriate. In the self-hosted workflow Originary does not receive or store private signing keys.
Records are standard JWS tokens, not stored in a proprietary database or tied to an Originary account. You can export, archive and move them. The protocol is designed for multiple independent implementations.
What stays with you, and what you publish.
The signing libraries, verification functions and SDK run in your environment. They do not send interaction data, record contents or business payloads to Originary.
Stays in your environment
- Private signing keys
- Interaction payloads and business data
- Record contents and claims
- Verification results and decisions
Published by you
- Public keys (JWKS endpoint)
- Issuer configuration (peac-issuer.json)
- Policy metadata (peac.txt)
- Signed records you choose to share
Originary does not run hosted verification, dashboards, or record storage. Data handling for a scoped pilot or supported self-host is covered in the Privacy Policy.
Legal identity and stewardship.
Originaryâ„¢ is the software and developer-tools brand of Poem, Inc., a Delaware corporation. Originary publishes and maintains PEAC Protocol, not its gatekeeper. The protocol specification, reference implementation, conformance suite, and all core tooling are published under the Apache-2.0 license.
Stewardship means we maintain the specification, publish test vectors, and ensure interoperability. It does not mean we control who can implement, extend, or build on the protocol. Anyone can build a conformant implementation without permission, payment, or partnership with Originary.
Policies and specifications.
- Security
- Privacy
- Terms
- Trademark
- Verify locally
- Record gallery
- PEAC Protocol
- peac.txt
- aipref.json
- Conformance suite
- GitHub Security Advisories
Questions about security, compliance or verification: contact@originary.xyz