Confidential Evidence

Evidence Bridge seals protected content as keyed, salted HMAC commitments before attestation, keeps private openings separate from the public record, and supports later selective verification.

A confidential CER contains commitments. The private opening contains the information necessary to verify a committed value. Conceptually:

Public CER

{
  "commitment": "hmac-sha256:..."
}

Private opening

{
  "field": "preState",
  "salt": "...",
  "value": {
    "status": "ONLINE"
  }
}

How openings are handled

The opening is not sent to the NexArt Node. Openings are:

tenant-scoped
record-family-scoped
stored separately from public CERs
excluded from public APIs
excluded from normal result responses
never logged

Selective verification

A verifier with the correct opening can verify that the disclosed value matches the commitment in the certified record. A wrong opening fails verification.

Raw payload handling

The original ingestion body is hashed, parsed, mapped and used to create evidence, then discarded rather than retained as a raw customer payload. The Bridge persists confidentiality-safe mapped values, provenance, hashes, evidence and tenant-scoped openings as appropriate.

Record-level visibility

Field disclosure is different from record visibility. Disclosure (Protected or Readable) controls what the CER reveals. Visibility (Public or Private) controls who can retrieve the Node-attested record and does not change the CER, certificate hash or signatures. A public CER may intentionally contain profile-authorized Readable fields; opening material for Protected fields always remains private. See Consequential Execution.

NexArt confidentiality uses keyed, salted HMAC commitments managed by the canonical SDK. This is not encryption, and a plain SHA-256 hash does not provide confidentiality.

For the underlying commitment scheme, domain separation and the V2 sealing API, see Confidential Mode.