Trust centre
Security that does not depend on trusting us.
EVstring is designed so that the integrity of a battery's history can be checked independently of the platform operator, while confidential data stays encrypted and access-controlled. This page explains how, and is honest about what is still in progress.
Architecture of trust
Six layers, and the last one cannot be talked out of its rules.
Conventional application security protects the platform. The ledger underneath protects the record, even from the platform.
- A state change must pass both the API role guard and the smart contract check.
- A compromised application server still cannot push a battery into a state its role does not allow.
- Per-organisation signing keys limit the damage any single key could do.
- The consortium admin can deactivate a participant on-chain and pause contracts in an emergency.
- 1
Edge
TLS in transit, strict CORS allowlist, security headers and a content security policy, rate limiting.
- 2
Identity
Passwords hashed with bcrypt, login throttling and lockout, short-lived access tokens, httpOnly SameSite refresh cookies.
- 3
API
Every endpoint carries an explicit role guard; request bodies are validated against whitelisted schemas.
- 4
Data
Parameterised queries, per-tier access checks, restricted files encrypted before storage.
- 5
Contract
Smart contracts re-check role and lifecycle state for every write. The API cannot override them.
- 6
Ledger
Append-only history replicated across validators; any record can be re-verified against it.
On-chain vs off-chain data
Nothing confidential, and nothing personal, is written to the ledger.
Blockchains are permanent and replicated, which is exactly what you want for proof and exactly what you do not want for private data. EVstring follows a strict hash-only rule.
Off-chain: the data
Battery specifications
chemistry, capacity, voltage, weight
Certificates & reports
carbon audit, composition, due diligence
Dismantling & safety docs
AES-256-GCM encrypted on IPFS
Telemetry readings
voltage, temperature, SoC, SoH
Personal data
VINs, owner details: never leave this side
PostgreSQL, TimescaleDB and IPFS. Access is checked per role and per tier; restricted files are encrypted.
On-chain: the proof
Passport token
ERC-721, one per battery, current holder
Metadata fingerprint
SHA-256 of the registered specs
Lifecycle events
state, acting organisation, timestamp
Document hashes
SHA-256 + IPFS content identifier
Telemetry Merkle roots
one root per time window
Permissioned EVM chain. Append-only: contracts enforce who may write what, and nothing is ever edited in place.
A fingerprint reveals nothing about the data behind it, yet proves that data has not changed since it was anchored.
Encryption
Encrypted in transit, encrypted where it matters at rest.
In transit
Restricted documents
Key wrapping
Integrity, separately
Credentials
Uploads
Access tiers
Three tiers, modelled on the EU regulation.
Who may see what is decided by tier and by role, and checked on every request. The public passport page and its data contain public-tier fields only.
Public
Annex XIII (1)Anyone who scans the QR code
Identity, chemistry, capacity, carbon footprint, recycled content, lifecycle summary, recovered-material totals.
Restricted
Annex XIII (2)Parties with a legitimate interest: service centres, second-life operators, recyclers, the battery's manufacturer and OEM
Detailed composition, dismantling and safety information, due-diligence documents, detailed performance data.
Regulator
Annex XIII (3)Regulators, auditors and the consortium administrator
Everything, including the full audit trail and market-wide analytics. Read-only.
Inside each organisation, admins, members and viewers have separate permissions. The full permissions matrix is part of every demo.
Key management
One signing key per organisation.
Every organisation has its own on-chain identity and signing key, so every event on the ledger is attributable to exactly one company.
- Keys are held by the platform's transaction service on behalf of each organisation; users never handle private keys.
- Keys are stored as protected secrets, never committed to source control and never written to logs.
- Separate keys per organisation limit the blast radius of any single compromise.
- Participants can be deactivated on-chain, immediately revoking their ability to write.
Hardware-backed custody
RoadmapFor production deployments we are adding support for a dedicated secrets manager (such as HashiCorp Vault), cloud KMS or hardware security modules, and for organisations that want to hold their own signing keys. We will update this page as each option becomes available.
Audit logs
Two audit trails: one you can edit, one nobody can.
On-chain event log
Every lifecycle transition, custody transfer, document anchor and material-recovery record is an on-chain event with the acting organisation, timestamp and a fingerprint of supporting data. It is append-only and can be replayed at any time to rebuild the platform's database.
Access log
Every access to a restricted document is written to an access audit log, so organisations and regulators can see who viewed sensitive information and when.
Data residency
Your data, in the region you choose.
Because the ledger holds only fingerprints, the confidential data and its location can be chosen separately from where validators run.
Regional hosting
Off-chain databases and document storage deployed in the region your obligations require.
Private deployment
The full stack is container-based and can run in your own data centre.
Consortium validators
Validator nodes can be operated by consortium members in their own jurisdictions.
Certifications & assurance
Where we stand, plainly.
EVstring is an early-stage platform. We would rather tell you exactly what is in place than display badges we have not earned.
Smart-contract assurance
- Built on OpenZeppelin's widely used access-control and token libraries.
- Automated tests cover the full lifecycle, including negative cases for every disallowed transition.
- Static analysis with Slither; a coverage target of 90% or more.
- No upgradeable proxies: deployed rules cannot be swapped out silently.
Certifications
EVstring does not currently hold SOC 2 or ISO/IEC 27001 certification, and no third-party audit of the smart contracts has been completed yet. Our controls are being designed with those frameworks in mind, and an independent contract audit is planned before production use.
Responsible disclosure
If you believe you have found a security vulnerability in EVstring, please tell us privately so we can fix it before it is exploited. Email hello@evstring.example with “Security report” in the subject, a description of the issue and steps to reproduce it.
- We will acknowledge your report and keep you informed while we investigate.
- Please do not access or modify data that is not yours, degrade service, or publicly disclose the issue before it is fixed.
- We will not pursue action against good-faith research that follows these guidelines.
Questions about our security posture for a procurement review? Talk to us
Get started
Bring your security team to the demo.
We are happy to walk through the architecture, the permissions matrix and the contract code with your security and compliance reviewers.