How attester.no works

NorskEnglish

attester.no proves a certificate is genuine – without ever storing what it says. This page explains exactly what happens to your data.

What happens to your submission?
  1. You fill in your organization’s form. The data is stored temporarily, only so the organization can review it.
  2. If the submission is not processed within 24 hours, it is deleted automatically – you would then need to submit again.
  3. When the organization approves, the certificate is generated as a PDF with a QR code, and you receive it from the organization.
  4. Your data is deleted automatically 24 hours after submission – whether or not the certificate has been issued. Until then the organization can regenerate the PDF if something went wrong. After that, only the cryptographic hash remains.
What is stored – and what is never stored?
After the certificate is issued, the database contains only:
  • A cryptographic hash (a “fingerprint”) of the certificate’s contents
  • Which organization issued it, and when
  • Which PDF template was used
  • A random ID that the QR code looks up
This is NEVER stored after issuance:
  • Your name
  • Positions, roles or groups
  • Dates and time periods
  • Everything else written on the certificate
How can the certificate be verified if the contents aren’t stored?

The QR code on the certificate carries the data – not the database. When someone scans the code, the verification page computes the fingerprint of the data in the code and compares it with the fingerprint we stored when the certificate was issued. If they match, the certificate is genuine and unaltered. Change as little as one character and they no longer match.

The consequence: should the database leak, no personal data leaks. The server does not even know who the certificates are about. Only the person holding the paper certificate – or the QR code – can read the contents.

How to verify a certificate
  1. Scan the QR code on the certificate with your phone camera.
  2. The verification page opens and shows green if the certificate is genuine and unaltered, red if something is off.
  3. Compare the fields on the page with what is printed on paper.
Questions?

Email hei@attester.no, or get in touch on GitHub. GitHub ↗

Back to the front page