We prove the fact, never expose the person

When AnVerified answers a verification, it releases one thing: a claim — enrolled, employed, resident, eligible — as a signed yes or no. The underlying record stays with the source that already legitimately holds it (the registrar, the payroll rail, the land office). AnVerified is not a database of people; it is a protocol that moves answers, and the answer it moves is the smallest thing the question ever required.

AnVerified does not copy, mirror or warehouse the registers it attests against. Each attestation source remains the custodian of its own data and answers about it. There is no central identity vault to breach, because there is no central identity vault to build — the whole point of the design is that no one, including us, accumulates a complete picture of anyone.

Every verification is issued to a pairwise pseudonym scoped to the relying party that asked. The identifier a bank sees is mathematically unrelated to the identifier a ministry sees. There is no global ID, and because the identifiers never recur across parties, no verifier can silently build a profile by watching the same person move through the system. This is the same no-join-key doctrine that runs across every Antrex product.

A verification carries a short time-to-live and can be revoked by its holder. Consent is captured per request, not granted once forever. AnVerified follows the OpenID standards it is modelled on — selective disclosure, verifiable credentials, minimal relying-party data — so what a verifier keeps after the check is a boolean and a timestamp, not a file.

AnVerified does not issue identities, replace myTNor or the national register, or decide who a person is. It attests facts that a legitimate source already knows about a person who chooses to present them. If you never use the protocol, nothing about you exists inside it — there is no passive collection, no shadow profile, no record of the questions you were never asked.

During design and the first relying-party pilots, participating institutions and any early verification volumes are named only with their consent. Results are reported without identifying any individual or organisation that has not agreed to be named — anonymity for the first cohort is a privacy rule, not a suggestion.

To ask how any field above is implemented, or to exercise rights over a claim involving you, write to anverified@antrex.app or use the Antrex contact desk at antrex.app/contact.