ZEROGRANT
You hold everyone's data.You can never give it back.
Applications need permission, not possession. ZeroGrant lets you borrow authority while the owner keeps control, and revoke ends the loan.
Sandbox never charges. Owner keys never touch your infrastructure.
Why this exists
If your application only needs the answer, why does it still own the evidence?
Permanent custody was never a product requirement. It was an architectural limitation. Sovereignty Theft is the cause: irrevocable handover of authority. Not the stealing of data. The stealing of authority.
What custody costs you now
The bill permanent custody is already running. Every number is third-party and current. The exposure remains yours until the architecture changes.
The payoff
A database breach no longer scales.
No plaintext database to steal. Every record requires a separate, live, authorised operation. Bulk exfiltration no longer produces bulk-readable data.
Traditional breach
Steal once. Read everything.
One exfiltration, and every row is plaintext the attacker can use forever.
48 records. 48 readable.
With ZeroGrant
- Steal the database. Receive ciphertext.
- Each record still requires live authority and an individually authorised operation.
- Decrypting millions of records means millions of governed attempts. Rate limits constrain it. Anomaly detection exposes it. Revocation ends it.
- Revoked records never open.
48 records. 4 live. 44 inert.
A breach finds nothing that works at scale.
What ZeroGrant does
Use only the data you need. For only the purpose granted. For only as long as authority exists.
Your application stores ciphertext. Owner-held keys never touch your server. ZeroGrant verifies live, purpose-bound authority and returns only the permitted result. Owners can grant, limit, and revoke access at any time.
No plaintext database
A stolen database yields ciphertext, not bulk-readable records.
Exact-scope access
Authority can cover a single field, fragment, claim, or derived answer, not the entire record.
Immediate revocation
Withdraw authority and every dependent permission ends.
Restore-proof enforcement
Restoring an old database cannot resurrect withdrawn access.
A scoped clearance intent
The application receives the answer it needs, not the evidence behind it.
Declare the purpose, the exact claims you want back, and the data that must stay excluded. Set the lifetime. ZeroGrant enforces it and returns proof, never raw evidence.
{
"purpose": "verify_employment_eligibility",
"requested_claims": ["eligible_to_work"],
"excluded_data": [
"passport_number",
"date_of_birth",
"home_address"
],
"expires_at": "2026-07-28T12:00:00Z",
"raw_data_exposure": false
}Live proof
Control stays with the owner.
They never transfer authority. They delegate it. Your application acts while that authority exists. Withdraw it, and every dependent permission dies with it.
The clearance result is what your application keeps: a bounded answer, a cryptographic proof, and raw_data_exposure: false.
// delegated authority. no permanent custody.
{
"intent_id": "ci_a1b2c3d4e5f678901234",
"result": {
"eligible_to_work": true
},
"raw_data_exposure": false,
"cryptographic_proof": "ntka_v1:b8d828…"
}How it works
Borrow authority. Act. Revoke.
Consent is continuous, not a one-time checkbox. Your application acts under delegated authority while it exists. The owner can end the loan at any time. Enforced by cryptography, not by a promise to delete.
- 01
Request access with purpose
Your server opens a ClearanceIntent. Nothing moves until the owner grants. Status stays requires_owner_action.
- 02
The owner grants, not transfers
They see purpose and recipient, then approve. Approval mints an owner-signed Mint Warrant, by biometric or equivalent. Access is delegated, never owned.
- 03
Act under live authority
Perform what the grant allows while authority exists. Withdraw consent, and the affected data is rotated to fresh authority that only holders of still-live grants can use. Copies of the prior ciphertext no longer open.
- 04
The owner ends the loan
Revoke at any time, no reason required. Every dependent permission dies with the grant, and a restored backup does not bring it back.
Prefer code first? Open the quickstart.
The architecture
Legacy versus SDARC.
Permanent copy versus conditional ciphertext. Transferred authority versus borrowed authority. Restore resurrects access versus restore fails closed.
Legacy
- The copy is permanent.
- Authority is transferred.
- Consent becomes a permanent copy.
- A breach is a catastrophe.
SDARC
- The copy is conditional.
- Authority is borrowed and revocable.
- Consent can be withdrawn, and the data reflects it.
- A breach finds nothing that works at scale.
Data flow
Legacy
- Application
- Database
- Plaintext
- Breach
- Everything
ZeroGrant
- Application
- Ciphertext
- Authority
- One answer
- Revoked
Same application. Different terminus. Everything or one answer, revoked.
The two hard problems
A restored backup does not restore access.
Every other system has the same escape hatch: revoke access, then quietly roll back a database, and the access returns. Consent you withdrew is live again and nobody can see it happened.
SDARC closes it. Authority state is committed two ways and anchored in a separate, restore-isolated record. Rewind the history and the system fails closed. Restore a backup and revoked access stays revoked. The one move an accidental or single-store restore depends on stops working.
Erasure that the data itself obeys.
Delete requests are a promise. Somewhere, a backup, a cache, a warehouse copy, the data usually survives the promise.
When an owner erases under SDARC, the authority that makes the data usable is retired. Remaining copies do not decrypt. The record does not answer. You are not asserting that every byte was found and deleted. You are proving the data no longer works, which is the answer a regulator and a court are actually asking for.
Origin and fit
A protocol proven where custody was most punishing, ready wherever an individual's data must stay under their control.
Proven under pressure
Built for cognitive and workplace profiles, where permanent disclosure destroys trust.
Source-agnostic
Works above any assessment, record or profile store.
Exact-scope control
Governs which field, for which purpose, to which recipient and for how long.
Start in your workspace
Install the SDKs, create an intent, and prove delegated access in sandbox. Owner keys remain on the owner's device. Your server stores ciphertext and receives only authorised results.
The internet learned how to identify people.SDARC teaches it how to leave authority with them.
Build with ZeroGrant.
ZeroGrant builds SDARC. Delegated by consent. Bounded by purpose. Revocable by design. Provable by cryptography. Sovereign for life.