Guides
Privacy and selective disclosure
What ECZ-ID publishes, what it deliberately does not, and how disclosure profiles keep evidence useful without exposing it.
The public record’s minimal disclosure is live. Public Intent disclosure is defined in Core and not yet enabled; Receipt disclosure profiles apply once Receipts are publicly retrievable, which they are not yet.
The public record discloses only what it must
- Organisation fields appear only with publication consent, and each says whether it was declared or externally referenced.
- Identifiers a family marks hash-only are never projected in the clear.
- The Resolver never shows IntentControl decision outcomes, and IntentControl reason codes are shown only to the signed-in account holder.
Intent disclosure is digest-only by design
Core defines a public Intent disclosure that is not yet enabled. By design it covers only Intents the owner chose to publish, that are authorised and not sandbox. It shows a reference, the actor, the state, the window, revocation, the authorisation kind, the principal’s assurance and a digest. It never shows the objective, constraints, destinations, parameters, principals or decisions, and it carries no signature.
Receipt disclosure profiles
| Profile | Who may see it |
|---|---|
PRIVATE | The account holder. The default. |
RELYING_PARTY_SHARE | A relying party the holder shares it with. |
PUBLIC_SAFE | Anyone, once public retrieval is enabled. Only current receipts with this profile are publishable. |
Local tools stay local
The published verifier, the editor extensions and the Python inspectors run on your machine. They upload no source, no secrets and no telemetry. This site sets no trackers.
Related
This page is explanation, not authority. Current state is only ever the live Resolver record. Live facts on this page were measured read-only on 2026-10-10.