Prove this record
is what it was.
A regulator's records request. A forensic auditor. Opposing counsel in discovery. Different rooms, same question. Most organizations answer with trust—0REI answers with mathematics. Every write becomes an Ed25519-signed seal with exactly two states: verified or broken. Provable with no network, no database, and no 0REI service running.
Single compiled binary. No runtime dependencies. Deploy anywhere in seconds.
Total deployment footprint. Runs on bare metal, containers, or embedded systems.
No cloud. No database. No external services. Your keys, your infrastructure.
Try to Break It
LIVE DEMOClick any field to tamper with a sealed record. Watch the cryptographic verification fail in real-time.
One Cryptographic Core. Eight Surfaces.
0REI is not one product—it's an evidence system. Create proof anywhere, transport it through anything, verify it without trusting anyone.
01 Evidence Core
The Rust API. Ed25519-signed seals over arbitrary JSON, with optimistic concurrency and structured conflict surfacing.
- Ed25519 seal over RFC 8785 canonical JSON
- OCC with structured HTTP 409 conflicts
- Atomic entity + seal write — no partial state
02 Merkle Attestation
Batched inclusion proofs over thousands of seals. Anchor one root hash publicly; make an entire history verifiable at once.
- SHA-256 binary tree over binding roots
- Per-seal inclusion proof, batch up to 10,000
- Third-party verifiable without 0REI credentials
03 Air-Gap Transport (ST3GG)
Seals embedded inside PNG images via steganography. Evidence that travels through courtrooms and air-gapped facilities.
- LSB steganography embeds the seal in pixels
extract-verifyconfirms offline, no DB- Survives image pipelines & exhibits
04 Delta Ledgers
Append-only delta entities for high-frequency settlement, with zero read-modify-write contention on the hot path.
- Increment · Decrement · Append · Set
- Advisory-lock sequencing, append-only log
- State materialized on read by replay
05 Hardware Trust
Pluggable HSM signing through the HsmSigner trait. Software signing is the default; hardware is a config swap.
- AWS CloudHSM reference path
- Azure · Thales Luna · YubiHSM · PKCS#11
- FIPS 140-2 L3 pathway (integration, not validated)
06 Embed Everywhere
The orei Rust crate and standalone 0rei-verify CLI. Seal and verify in-process — no HTTP, no server.
oreicrate — in-process library0rei-verify— standalone binary- Offline seal generation & verification
07 Supabase Bridge
Four Deno edge functions seal Supabase events at the source — table writes, storage objects, scan results.
seal-content·seal-verifyseal-scan-resultseal-retry-cron— scheduled retry
08 Genesis Anchor
A signed, version-controlled cryptographic origin point. The chain of evidence has a verifiable day zero.
- Signed at deployment bootstrap
- Committed to source control
- Same verify path as every operational seal
Why This Exists
Disputes are expensive. Regulators are relentless. Logs are editable. 0REI gives you verifiable integrity at the point of record.
01 Non-repudiation
Cryptographic signatures bind metadata and payload hash into a verifiable commitment. Once sealed, alteration is computationally infeasible.
- Deterministic payload canonicalization
- Collision-resistant hash + field binding
- Asymmetric signature over sealed payload
02 Crash Survivability
The durable storage layer persists events through failure modes using crash-safe write patterns. Network dies? Data stays safe.
- Network partition mid-seal
- Process crash during write
- Storage full / disk failure
03 Offline Verification
Your team validates seals without network access or vendor dependencies. Zero lock-in. Forever portable.
- A laptop (any OS)
- The Evidence Packet ZIP
- No internet. No vendor. No keys.
Built by Someone Who Knows What's at Stake
Mark Askey
Navy combat medic. Schlumberger and NOV field operations. Corporate VP across aerospace, biomedical, and robotics manufacturing inside ISO 9001, ISO 13485, ITAR, and DFARS quality systems.
I built 0REI because I've seen what happens when evidence isn't tamper-proof. In regulated industries, "trust me" isn't good enough. The record has to prove itself.
Built for Regulated Industries
Any environment where evidence integrity is non-negotiable.
Financial Services
Trade confirmations, regulatory filings, audit trails. Tamper-evident records that survive examiner scrutiny.
Healthcare
Patient records, consent forms, compliance evidence. HIPAA-grade integrity without cloud dependency.
Defense & Aerospace
ITAR-controlled documents, chain of custody, inspection records. Air-gap ready for classified environments.
Legal
Contract execution, discovery preservation, chain of evidence. Cryptographic proof that holds up in court.
Supply Chain
Provenance tracking, certificates of origin, inspection records. Immutable proof from source to destination.
Energy & Utilities
SCADA telemetry, pipeline inspection logs, regulatory compliance. Evidence that survives field conditions.
What You Ship to Auditors
A self-contained proof bundle with zero dependencies on our servers. Verifiable offline, forever.
core/ canonicalized payload
core/ cryptographic manifest
proof/ standalone verification tooling
proof/ pre-computed verification proof
docs/ technical specification
Proof Sprint
Two weeks. Fixed scope. Fixed price. We deploy, wire one stream, generate evidence, deliver closeout report.
Start Your Proof Sprint →AWS QLDB was deprecated July 2025
If your audit trail lived on QLDB, you need a replacement that doesn't lock you into another cloud. 0REI runs on your hardware, verifies offline, and produces portable evidence packets your team controls.
Your metal. Your keys. No cloud dependency.
Zero network requirement. Zero telemetry.
Evidence Packets verify without vendor access.