GateReceipt: signed Decision Receipts
An Ed25519-signed Decision Receipt on every screening: inputs, list snapshot hashes, policy version, signals.
Start free sandboxTalk to us50 screenings a month free, no card.
On this page
GateReceipt in simple terms
Every decision produces a signed record: what was checked, against which version of each list, under which rules, and what was decided.
If anyone changes a single character afterwards, the signature no longer matches, and anyone can check that without asking us.
IN EVERYDAY TERMSThink of a sealed envelope with a wax stamp. You can read it any time, and everybody can see whether the seal was broken.
What it does
Every decision produces a Decision Receipt: a portable record of the inputs hash, the content hashes of the sanctions snapshots used, the coverage matrix, every signal, the policy version, the decision and the timestamp, signed with Ed25519 and stored append-only. Human actions on the case are recorded on the timeline the receipt anchors.
The other Prove modules build on the receipt: replay reads its stored inputs, evidence packs embed it, and the monthly report counts from it.
The same stored records are readable by an AI assistant through the read-only MCP endpoint (/api/mcp) with your tenant key: get_screening, get_case, replay_screening and get_receipt_key return the same data as the REST API, and none of them can write.
Why a broker needs it
When an examiner asks, a year later, why a deposit was accepted, a dashboard screenshot is not an answer. You need a record that can be shown to be what was produced on that day, not a log that could have been edited. A signature that anyone can verify against a published public key shows this without relying on the vendor's word.
How it works
The receipt's fields are serialised as canonical JSON with recursively sorted keys and signed with KYTGate's Ed25519 signing key. To verify: fetch the SPKI public key from /api/v1/receipt-key, remove the signature field, serialise the same way, strip the ed25519: prefix and verify. Every evidence pack ships these instructions inline, and the in-browser verifier runs the same check without uploading anything.
Try it without an account: Decision Receipt verifier (in-browser, no account).
What it does not do
A receipt proves integrity, not correctness: it shows the record is byte-for-byte what was produced, and the coverage matrix inside says what was and was not checked. On its own it also cannot prove WHEN it was produced. The signing key is ours, so a signature alone never rules out a backdated record. GateAttest covers that. The receipt does not include data you did not send (processor evidence, customer events). Those gaps are visible in it, not filled by it.
API
GET /api/v1/receipt-key
{ "configured": true, "algorithm": "ed25519", "spkiBase64": "MCowBQYDK2VwAyEA…" }
// verify: remove "signature", serialise with recursively sorted keys,
// strip the "ed25519:" prefix, verify against the SPKI keyFull reference: /docs#receipts · OpenAPI 3.1