Your data stays where it sits. Certisyn offers 6 ways to run the check, ordered from a named region to a device with no network, and the sealed result is the same in all of them. A residency requirement decides which one a pilot uses.
The check runs in the AWS US West (Oregon) region through the platform provider. You choose what is submitted, and every record is sealed on receipt.
A published manifest names the residency jurisdiction, the policy versions and the regulators the deployment answers to. Anyone can read it and check its hash.
The verification boundary ships as a container into your environment and only a sealed receipt crosses to Certisyn. Hardware attestation quotes from the host are recorded as read.
The assessment runs in the browser of the party who holds the evidence. The evidence is read, folded into counters and discarded. Verdicts, counts and a signature reach Certisyn.
A device signs each capture with a key it generated and keeps, holds it through an offline window of any length, and submits it when there is a connection. The signature is checked against the enrolled device.
The master secret is shared across parties and assembled in no single place, so signing and unsealing take more than one party.
Every mode produces the same sealed verification record, signed under published keys and checkable offline with the public key and the record. Where the boundary forbids egress, the seal stays inside the perimeter, and the client edge mode holds that line on custody grounds because the perimeter belongs to the client.