Independence
Proof, not promises
Rightshold cannot see your records, and cannot rewrite or backdate the history it has countersigned without publishing evidence of the rewrite. Every step of that proof is checkable with the published anchor/1 specification and standard tools — the same recomputation this page is built from.
Computed at the moment this page is served, from the same public views the API serves. Snapshot: 2026-10-23T18:05:46.644Z · super-roots (JSON) · chain explorer
How a day becomes unrewritable
Anchors arrive all day, each one a fingerprint of a client's own hash-chained history, countersigned by receipt the moment it lands. When the UTC day closes, the day's anchors are folded into a single fingerprint — a super-root — whose first leaf commits to the super-root of the day before, so the days chain the way the records do. The super-root is then handed to public OpenTimestamps calendars, which batch it into a Bitcoin transaction, and independent witnesses recompute it and cosign what they found. Three states, kept separate on every surface: anchored (computed and chained here), stamped (with the calendars, waiting on Bitcoin), Bitcoin-confirmed (a block height is known and the proof file checks with stock tools).
No super-root has been sealed yet
No UTC day has closed since anchoring began. The first super-root folds in the first completed day, chains forward from there, and appears here with its Bitcoin stamp and witnesses. Until then, the honest state is the one in the window below: today's anchors are countersigned by receipt, and not yet externalized.
The window, shown rather than hidden
These anchors sit in today's still-open UTC day (or a day whose super-root has not been computed yet); the daily super-root folds them in when the day closes. Right now the oldest commitment that exists only inside Rightshold is 12.9 hours old (since 2026-10-23T05:12:43.292Z). The target is a day or less, closed every midnight UTC; receipts and the root-to-root chain cover the inside of the window, and Bitcoin and the witnesses close it.
Verify it yourself
No account, no key, no permission — and none of our code. The day's anchors and leaves are public, the leaf construction is written into the anchor/1 specification, and the proof files are standard OpenTimestamps:
curl -s https://www.rightshold.com/v1/anchors/super-roots/{date}
curl -sO https://www.rightshold.com/v1/anchors/super-roots/{date}.ots
ots verify -d {super_root} rightshold-anchor-super-root-{date}.ots
Or with the Rightshold CLI: rightshold anchor super-root reads the same views and re-checks every witness signature against the key on the witness's own domain. If your recomputation ever disagrees with this page, the page is wrong and you hold the proof — that asymmetry is the design.
What Rightshold cannot do
It cannot read anchored records: clients chain records at home under a secret salt and send only Merkle roots, counts and timestamps; the protocol has no field that could carry a record. It cannot backdate: a super-root first stamped on Thursday cannot be presented as Tuesday's, because Bitcoin holds the Thursday stamp and the chain links each day to the one before. It cannot quietly rewrite a countersigned day: changing any anchor changes that day's super-root, breaking every later day and contradicting the copies held by Bitcoin and by each witness. And it cannot invent a witness: cosignatures check against keys on the witnesses' own domains.
What it still controls, said plainly: whether the service is online tomorrow. Rightshold is operated, by a company — not by nobody. So the proofs are built to outlive the operator: every receipt a client holds, every witness cosignature and every Bitcoin stamp keeps verifying with this site gone.