The three verbs
1
Anchor
Your agent hashes each step locally and sends a signed commitment to it. The step’s
content stays with you.
2
Read
You resolve your own records later, through the API or the console, when you need to
assemble evidence.
3
Verify
Whoever you hand evidence to checks it themselves, offline, against the open kernel.
What crosses the boundary
This table is the product. Everything else is mechanism.
Being content-blind is not a privacy feature bolted on afterwards. It is why we cannot
alter your evidence, and why an auditor does not have to take our word for anything.
Who holds what
Three parties, and none of them has to trust the others.The witness
Sanning commits your records to a public record on an interval, not one transaction per event. A Merkle tree covers everything anchored in that interval, and the root is what gets published. That choice has consequences worth understanding before you build against it:- Cost tracks intervals, not volume. Anchoring ten thousand events in an interval costs what anchoring one does.
- Evidence is not instant. A record becomes part of a pack once the interval containing it is sealed and published. See The witness.
- An inclusion proof is small. Your counterparty checks one record against a published root without holding anyone else’s data.
What you must keep
Sanning holds commitments, so it cannot give your raw data back. You keep it. The SDK writes to a log store you own, and it writes there before anchoring. A store failure means no anchor, deliberately: a commitment to bytes you cannot produce is the one unrecoverable state in the system. See Keep your log store.Where to go next
Quickstart
Anchor a record and verify it, in about ten minutes.
What a verdict does not claim
The limits, stated plainly. Read this before you rely on one.