Ark · Station
One desktop. Five modules. Zero strangers.
The Station is an Electron desktop application that bundles your identity vault, document signer, verifier, mesh node, and proctoring engine into a single auditable shell. Every sensitive operation — from biometric liveness to PDF signing — runs on your own hardware, on code anyone can read.
Five capabilities, one shell
The Station is a composition of independent modules that share a single encrypted vault. Each module is opt-in. You can run the Station purely as a vault, purely as a verifier, or activate every module for a full sovereign-identity workstation.
Core
Vault
Encrypted local key store. Ed25519 signing key + xsalsa20-poly1305 + scrypt key derivation. The private key never leaves the device — not even to the Attestto company.
- xsalsa20-poly1305 + scrypt
- Shamir 2-of-3 backup (planned)
- Zero-knowledge to Attestto
- Open source — auditable
Signer
Sign PDFs with your vault key. Produces W3C Verifiable Credentials embedded directly into the document metadata. Recognized natively by verify.attestto.com — no plugin, no Adobe, no cloud.
- Attestto self-attested signatures (Ed25519)
- Counter-signs Firma Digital PAdES files
- Smart-card PKCS#11 (planned)
- Byte-frozen output for forensic integrity
Verifier
Drop a PDF onto the Station, get a forensic report: signature integrity, certificate chain, document hash, tamper detection. Same engine that runs at verify.attestto.com — but offline.
- PAdES + Attestto self-attested
- National PKI roots (per jurisdiction)
- Tamper-evident byte-range checks
- Works without internet
Network
Mesh Node
Every Station can become a peer in the Attestto Mesh — an encrypted libp2p network for credential anchoring, trust mirroring, and redundant verification. Blind-courier: nodes can't read what they carry.
- libp2p over Bluetooth, WiFi, internet
- Blind courier — encrypted payloads
- Public ledger anchoring (deployment-time)
- Opt-in, never required
Proctor
White-box exam proctoring that runs entirely on the candidate's machine. Camera, screen, and process monitoring with zero cloud video upload. The "proctor" is auditable code, not a stranger watching a feed.
- Local face + liveness detection
- desktopCapturer screen monitoring
- Process-level lockdown via Node
- SHA-256 session hash + Ed25519 signing
Bridge to Browser
The Station pairs with the Attestto ID extension via the open @attestto/id-wallet-adapter
protocol. Web pages discover the wallet, request signatures, and receive credentials — without the
Station ever exposing your private key to the page.
- postMessage protocol, no servers
- DID login, document signing, credential push
- Works with any compliant wallet
- Cross-platform (desktop, browser, mobile PWA)
A browser engine with hardware access
Sovereign identity needs deep access to the device — camera, screen, processes, file system, smart cards — which a sandboxed web page cannot provide. Electron gives the Station the Chromium rendering engine for a modern UI and Node.js for direct hardware access. The result is a modular desktop that ships as a single installer and runs everywhere your team already works.
Chromium engine
The same rendering pipeline that powers verify.attestto.com runs the Station's UI. PDF preview, OCR, biometric overlays, signature stamps — all rendered with web technology you can inspect.
Node.js system access
Direct file system, process inspection, smart card interfaces, mesh networking, and OS-level keychain integration — capabilities a normal browser refuses to grant.
Auditable distribution
The Station ships as a notarized DMG, MSI, and AppImage. Source code is open. Reproducible builds are on the roadmap so anyone can verify the binary matches the published commit.
Five honest tiers
A signature is only as trustworthy as the identity verification behind it. The Station surfaces an explicit trust tier on every credential it issues, so verifiers and counterparties know exactly what evidence the signer presented.
Smart card
Costa Rica Firma Digital smart card (PKCS#11). Qualified electronic signature recognized under Ley 8454.
Full KYC
Cedula scan + Padron Electoral + facial recognition + liveness proof + Firma Digital seal.
Padron verified
Cedula scan + Padron Electoral cross-check + facial recognition + liveness proof. The default for citizen-issued credentials.
Document only
Cedula scanned and OCR'd, no Padron cross-check, no biometrics. Useful for non-binding workflows.
Self-declared
Holder-asserted data with no external verification. Always labeled, never silently upgraded.
Read the code. Run the binary. File issues.
Every claim on this page is backed by a public repository. If anything looks wrong, the right move is to open the source — not to take our word for it.
Core Applications
attestto-desktop
The Station itself. Vault, signer, verifier, proctor, mesh node — all in one Electron app.
attestto-verify
The browser-side verification engine. Same code runs at verify.attestto.com and inside the Station.
Infrastructure
id-wallet-adapter
The open wallet handoff protocol that bridges browser pages, the extension, and the Station.
attestto-mesh
The libp2p mesh node. Blind-courier transport, Public ledger anchoring, peer discovery.
Security
attestto-trust
Independent public mirror of national CA roots — a reference, never a replacement for the issuing authority.
SECURITY.md
Coordinated disclosure for any vulnerability you find. We acknowledge every report, in writing, with a tracking ID.
Run sovereign identity on your own desktop
The Station is in early access for professionals, institutions, and auditors. Tell us who you are and what you would use it for, and we will get you a build that fits your jurisdiction.
Request early access