Trust Center

Everything you need to decide whether to rely on a destill.ai receipt: who stands behind it, which key signs it, how to check that key yourself, and where our evidence ends.

Operator

Lebensfluss e.V., Gratkorn bei Graz, Österreich — ZVR-Zahl 1758759096
[EINFÜGEN: Straße und Hausnummer]
Represented by the board of the association. Full legal notice: Impressum · Privacy

General: hello@destill.ai · Data protection: privacy@destill.ai · Security reports: see security.txt

Keys and fingerprints

Receipts are signed with one key. Its public key is published as and as a PEM file. Compare the fingerprint below with the key your verifier uses; this page checks itself against both files when it loads.

Key id	`did:web:destill.ai#key-1`
Algorithm	(FIPS 204), 1 952-byte public key
Published at	/.well-known/did.json (field `publicKeyHex`) · /poaw/destill-key-1.pem
SHA-256 of the PEM key (DER, SubjectPublicKeyInfo)	280b740e3c288dc219acdb338dba1ceac38e19e3073ce1e6cb6de32ca9cff4a7
SHA-256 of the raw key (`publicKeyHex` bytes)	fa609e758194aea42015d38b12a191659c22e2cf7da9b37840269aaefaf6299c

Check it yourself

curl -s https://destill.ai/poaw/destill-key-1.pem | openssl pkey -pubin -outform DER | sha256sum
curl -s https://destill.ai/.well-known/did.json | python3 -c "import sys,json,hashlib;print(hashlib.sha256(bytes.fromhex(json.load(sys.stdin)['verificationMethod'][0]['publicKeyHex'])).hexdigest())"

A match shows that the key files and this page agree. All three are served by destill.ai, so they do not protect against someone who controls this web server; for that, compare the fingerprint over a second channel (for example a signed contract annex or a call with us).

Key lifecycle

Step	Today	Status
Custody	Software key on our own server; not in hardware (HSM).
Publication	did.json and PEM on destill.ai, fingerprints on this page.
Rotation and revocation	Not built yet. Today there is one key and no signed revocation list. Planned: signed, logged revocation with `revoked_at`, a compromise playbook, and re-time-stamping of older receipts (plan K6).
Time stamps	Receipts carry an RFC 3161 time stamp from an independent authority, so once a compromise date is known, receipts time-stamped before it keep their value and later ones can be rejected.
Certificate chain of the time-stamp authority	Not yet fully checked by our verifiers.

Threat model

What a check catches, and what it does not. Use the threat-model template to apply this to your own deployment.

Someone tries to…	Result
change a step, an amount or a time in a receipt after signing	Detected: the root hash and the signature no longer match.
remove or reorder a step	Detected: the hash tree over all steps, in order, is what is signed.
rewrite a receipt and sign it with their own key	Detected if you check the key: the fingerprint is not the one above.
let the agent log something false before it is signed	Not detected. A receipt shows what was recorded and that it has not changed since; it does not show that the record is true.
steal our signing key	Not detected by the signature alone. Limited by time stamps; rotation, revocation and hardware custody are not built yet (see lifecycle).
take over the destill.ai web server and swap the key files and this page together	Not detected by the browser check. Compare the fingerprint over a second channel, or verify offline with OpenSSL against a PEM you saved earlier.
forge a time stamp	Depends on the time-stamp authority (DigiCert); its certificate chain is not yet fully checked by our verifiers.

Non-goals

Sub-processors

Company	What for	What they receive	Where
Hetzner Online GmbH	Hosting of destill.ai and our services	All traffic to destill.ai	Germany / Finland (EU)
Let's Encrypt (ISRG)	TLS certificates	Domain names only	USA (public CA)
DigiCert, Inc.	RFC 3161 time stamps on the sample receipts	A SHA-256 hash, no content and no personal data	USA (public time-stamp authority)

The pages load no fonts, scripts or trackers from other companies. Details: privacy notice.

Benchmark sources

Module	What is published	Where
Proof of Agent Work	Test suite with the RFC 9162 test vectors of transparency-dev/merkle, tamper and fuzz tests; independent Python and OpenSSL checks.	poaw-cose.test.js · /poaw/ (section for engineers)
Fortress	First robustness run: one machine, 12 photos, raw files included. A direction, not a final figure.	/fortress-pitch/benchmark/
AEGIS	No detection rate is published until a reproducible public rerun exists.

Templates

DSFA / DPIA template (GDPR Art. 35, German with English headings) for using Proof of Agent Work in your own processing.
Threat-model template (English) for deploying receipts in your agent pipeline.

Change log

Date	Change
2026-10-25	Trust Center published. Pages load fonts and crypto libraries from destill.ai only (no font or script CDN). security.txt, robots.txt and sitemap added. One legal line with the operator on every page. Page claims checked by a lint against `content/status.yaml`.
October 2026	Receipts switch to COSE (`poaw-receipt/2`, profile of RFC 9942/9943); the earlier JSON format (`poaw-receipt/1`) is still accepted by the verifier.