Don't trust us. Check us.

Every claim CandidSignal makes ships with the means to verify it: no permission needed, no account, no asking us first. This page is the index of everything an outsider can check right now, plus the honest list of how we could cheat and how you'd catch us.

What you can verify today, from your own machine

The anonymity mechanics, live. app.candidsignal.com: take a survey as a fake employee, watch each cryptographic step narrated, try to submit twice (refused), and get a receipt only you can tie to your answer.
The public transparency log. github.com/awsventures/aws-candidsignal-transparency-log: signed tree heads, published continuously, with the log's public key. Git history makes silent rewrites visible.
Your own receipt's inclusion. After responding in the demo, the page prints the exact commands that verify the log's signature and your receipt's inclusion in it, from published files alone.
The counters. Per survey: credentials issued vs. redeemed. The invariant anyone can check is redeemed ≤ issued ≤ eligible headcount.
The browser bundle's integrity. The SDK ships with SRI (Subresource Integrity) hashes and builds reproducibly: the same source always produces byte-identical output, so an auditor can rebuild and compare.

The trust model, one paragraph

Anonymity is unconditional; integrity is conditional but auditable. Linking a response to a person is impossible: the respondent's browser blinds their credential before signing (RFC 9474 blind signatures), so the information needed to make the link is never created, and full collusion of vendor + employer + CandidSignal cannot reconstruct it. Tampering with results, by contrast, is detectable rather than impossible: every redemption and every counter goes into a signed, append-only Merkle log (the mechanism behind Certificate Transparency), mirrored publicly. We never claim both halves are absolute, and we recommend distrust of anyone who does.

How we could cheat, and how you'd catch us

The cheat	The catch
Quietly issue extra credentials and stuff a ballot	Published per-survey counters: anyone checks `redeemed ≤ issued ≤ headcount`. Over-issuance is arithmetic, visible to any auditor.
Edit or delete responses after the fact	The Merkle log is append-only and its tree heads are signed and externally mirrored; any rewrite breaks consistency proofs that anyone can run.
Serve respondents modified browser code that leaks the token	Reproducible builds + SRI hashes: rebuild from source, compare bytes. A page serving different code fails its own integrity attribute.
Correlate identities via metadata (IPs, timestamps)	Services do not log IPs or fine-grained timestamps against tokens; that's enforced in code and covered by tests. Log entries carry only coarse batch times. Verifiable in the source.

What the math does not solve, stated plainly: small-cohort inference (a five-person team's writing styles are recognizable regardless of cryptography; cohort-size discipline lives in the vendor's reporting layer), and self-identification (type your name in a comment box and you've signed your answer).

The code

The cryptographic core (blind-signature issuance, the redemption state machine, the Merkle log, and the audit CLI) is open source: github.com/awsventures/candidsignal. Clone it, read it, run the test suite, rebuild the browser bundle and diff it against what we serve. The audit tooling and log data are also public in the transparency-log repository. Our architecture decision records, including the trade-offs we'd rather not have, are shared the same way: ask and we'll send them.

Found something?

If you find a flaw (a linkage path, a metadata leak, a proof that doesn't hold), we want it, and we'll credit you or keep you anonymous, your call. hello@candidsignal.com, subject line "Security". A system that tells you where to point the flashlight should also thank you for pointing it.