OpenSig

Introducing OpenSig. Privacy-first IP protection for the digital age. Timestamp your creative work on blockchain before you share it. Files never leave your device. Beta is live now on iOS & Android. First 3 timestamps free. → opensig.net

The idea behind OpenSig is different from any other traditional document signing tools. Here's why. With traditional digital signatures, your proof can depend on a certificate authority. If that authority's root certificate is compromised or revoked, signatures relying on it may need to be revalidated. Your document hasn't changed. The authority validating it has. OpenSig takes a different approach. It creates a fingerprint of your file and anchors it to a public blockchain. Your file stays on your device. The proof is publicly verifiable and doesn't depend on OpenSig continuing to exist. That's the idea behind OpenSig.

Our founder @cryptoyoda once said Web3’s goal is to turn the web upside down, so you hold your own data and decide which apps get access and on what terms. This week a New Mexico judge ordered Meta to pay $25 billion after a jury found Facebook had misled users for years about how their personal data was handled and shared, and Meta says it will appeal. That is the web most of us still live on, where our data sits in someone else’s system. OpenSig is one small step the other way. Your file never leaves your device while its cryptographic fingerprint goes on a public blockchain, so you hold independently verifiable evidence that the exact file existed by that point in time, without depending on any company to preserve it.

Mobile apps often market "local file processing," but secretly transmit your document metadata, IP address, and byte sizes to third-party cloud telemetry endpoints the moment you open a file. OpenSig Mobile enforces an absolute network boundary. When you stamp a document on iOS or Android: > WebAssembly executes inside isolated client RAM, calculating the SHA-256 byte digest locally. > Zero background telemetry, tracking SDKs, or raw document payloads touch a network socket. > Only the 256-bit mathematical proof anchors directly to @0xPolygon. Complete local isolation. Zero cloud sync. Zero metadata leaks.

When models are trained on constantly shifting web crawls and undocumented data pipelines, proving what came first becomes a serious problem. If your team can't prove what data was ingested, where it came from, and when it was recorded before training began, you could spend years fighting over data history instead of building. The problem is not just knowing what went into a model but being able to prove it later. Data provenance is not just a compliance detail. it could be the difference between having evidence and having to argue your case from memory.

Recent incidents like the Double Counter and ASOS breaches prove a critical vulnerability: securing your core infrastructure doesn't matter if your third-party SaaS vendors and integrations leak your data. Uploading sensitive contracts, NDAs, or verification files to remote third-party platforms creates an unmanageable attack surface. OpenSig enforces zero-cloud execution at the browser layer. WebAssembly calculates the 256-bit SHA-256 digest directly inside local client RAM, your document payload never crosses a network socket or sits in a vendor's bucket. Only the mathematical proof anchors to @0xPolygon. Zero third-party cloud uploads, zero supply-chain risk, total privacy.

Something gets made at 2am. It gets shared. Three years pass. Then it comes back wearing someone else's name. The question at the end of that story is always the same. Which one came first. OpenSig exists so that question has an answer👇

Six things people use as proof, and how each one fails. The seventh does not depend on a copy, an account, or a platform.

For the first time in the United States, a jury is hearing an AI copyright case brought by artists. Andersen vs Stability AI went to trial this month. Everyone is arguing fair use. The more instructive part is how long it took to get here. Three years, much it spent in a baseline. Which specific works, owned by which specific people, existed when. Worth being precise about something. Most of that difficulty sat on the defendant's side of the ledger, in undocumented training data. No timestamp on your own work tells anyone what a lab scraped. What it does do is remove your half of the problem entirely. Your own provenance stops being something you reconstruct under deposition and becomes something you already hold. We anchor a fingerprint of your file to @0xPolygon in seconds. The file stays on your machine. Half the evidentiary burden, solved in advance.

The recent IDScan cloud breach exposed over 153 million driver’s licenses and passports on the dark web. It’s a harsh reminder of a fundamental architectural flaw: centralized verification cloud servers are massive honeypots waiting to be exploited. When you upload a sensitive documents to a cloud platform to prove authenticity, you surrender custody of your data. OpenSig fixes this at the execution layer. Instead of routing files to a remote server, OpenSig runs local WebAssembly modules directly inside client RAM. Your sensitive files never cross a network socket. It calculates a 256-bit SHA-256 digest on-device, anchoring only the mathematical proof to the blockchain. Zero cloud uploads, zero honeypots, and total document privacy.

Most cloud document verification apps have an architectural flaw because they force your document across a network socket to verify it on a remote server. Under NIST SP 800-63-4, security teams call this the "injection attack" surface, where intercepted network streams allow malicious actors to substitute files in transit before cloud engines process them. If your file touches an external API to prove it’s real, it is not private, and it is not truly air-gapped. OpenSig kills this vulnerability at the execution layer. When you drop a file into OpenSig, compiled WebAssembly modules execute 100% inside your local device RAM. Your raw file never leaves your machine. It calculates a 256-bit SHA-256 digest locally, anchoring only the cryptographic proof to the blockchain. You get zero cloud uploads, zero stream injection risk, and local mathematical certainty.

AI-generated document fraud is making forged invoices harder to distinguish from legitimate ones. Scammers can clone invoice templates, change payees, and alter bank-routing details often without leaving obvious visual clues. OpenSig shifts invoice verification from visual to cryptographic proof. When an issuer stamps an invoice, OpenSig calculates its SHA-256 hash locally in the browser using WebAssembly, then anchors the timestamp on @0xPolygon. If anyone changes the PDF, even a routing number, character, or single byte, the document’s hash no longer matches. Drop the file into OpenSig, and the modification is detected instantly

A note for AI labs and open source research teams. Priority disputes over datasets, model weights, and distillation are now routine, and proving when you created a checkpoint matters. The usual problem is that every timestamping service asks you to upload the artifact first, and that's not an option for proprietary weights. OpenSig hashes any file locally. Not just documents, any byte stream, dataset archives, checkpoints, config bundles. The fingerprint is computed on your machine and only the fingerprint is anchored to @0xPolygon. No byte of the artifact reaches a server, ours or anyone's.

For decades, digital trust relied on visual checks: Looking at a signature on a PDF, opening a cloud portal, or reviewing attached images. In an era of generative AI tools that can modify document text in seconds, image-based verification is broken. Organizations and global standards like NIST are pivoting toward cryptographic verification to prove identity and file integrity. OpenSig brings this cryptographic standard directly to your local machine. Instead of uploading files to centralized cloud databases, the OpenSig app executes local WebAssembly modules to process the file inside client RAM. It generates a fixed 256-bit SHA-256 digest, creating an immutable mathematical proof anchored to the blockchain. By shifting from image inspection to local deterministic hashing, OpenSig lets anyone verify file authenticity instantly without exposing sensitive contents to external servers.

Traditional e-signature platforms have made a basic business necessity painfully expensive. Small teams now pay up to $45 per user monthly while being locked into strict annual envelope limits and surprise overage fees. This is one of the predatory OpenSig subscription model with on-device execution and pay-as-you-go proof anchoring. When you sign or stamp a document in the OpenSig app, your device handles 100% of the computation locally. You generate a 256-bit hash, anchor the timestamp proof to the @0xPolygon blockchain. No monthly retainers, no envelope caps, and zero central server vendor lock-in. Verification stays free for anyone, forever.

A commodity trading firm nearly lost $6.6m when scammers intercepted an invoice email and altered the supplier bank details. Law enforcement managed to intercept the wire, but relying on luck and central email servers is a major risk. This is the exact is what OpenSig eliminates. When a vendor creates an invoice, the OpenSig app processes the raw file locally in device RAM, generates a 256-bit SHA-256 hash, and anchors that timestamp directly to the blockchain. If a scammer alters a single character, routing code, or total amount on that PDF, the file hash changes completely. The recipient drops the incoming invoice into the OpenSig app to run an instant local verification. A single byte mismatch immediately flags the document as tampered before any wire transfer occurs. No cloud uploads required, no central server compromises, and total local data privacy.

New month. Whatever you make in the next thirty days, make sure something outside your own memory knows when you made it. > opensig.net

Traditional e-signature SaaS platforms lock users into monthly subscriptions and envelope limits just to lock down basic file proofs. OpenSig eliminates account lock-in, recurring monthly fees, and vendor platforms entirely. You process your document locally, generate a 256-bit cryptographic digest on your device, and anchor the timestamp directly to the blockchain.

Someone once posted here on X that ''there is no IP protection, the best we have is trade secrecy''. Half right. Registration is slow. Enforcement is expensive. Most creators cannot afford the courtroom where their rights theoretically live. So people keep their work secret and call it protection. But secrecy has a fatal weakness. It only works until you share, sell, pitch, or publish. What survives contact with the real world is not secrecy. It is evidence. A dated, independent record of what existed before anyone else touched it. That is not full IP protection, and it does not replace registration or legal enforcement. But it is something you can create yourself, in about a minute, before you share your work with the world. Secrecy protects work nobody sees. Evidence protects work the world does.

Exactly right. A timestamp answers one question only. When. Authorship, rights, and provenance all need their own evidence, and anyone who tells you otherwise is selling something. The reason when still deserves its own infrastructure. Every other kind of evidence can be gathered after a dispute begins. The date cannot. It either existed before the question arose or it never will.