Sign It

Decentralized document signing and verification. Signing happens in your own Flowsta Vault - your keys never leave your device, you approve every signature, and there's no one in between.

What It Does

Sign It lets you cryptographically sign any file to prove:

• You signed it - Ed25519 signature made with your key, on your device, tied to your Flowsta identity
• When you signed it - timestamp recorded on Flowsta's tamper-proof network, built on Holochain
• Your terms - license, commercial availability, AI training policy, plus an optional Public Note
• Content integrity - steganography and hidden content checks

Anyone can verify a signed file at flowsta.com/sign-it/verify - no sign-in needed. For an exact check the file is hashed in your browser and nothing is uploaded; similar-file detection sends the file to the server for fingerprinting and discards it.

How It Works

Sign

Signing lives in Flowsta Vault, the desktop app that holds your keys:

1. Drop files into Vault - Drag one or multiple files (up to 10 GB each). Vault hashes each file locally, runs integrity checks, and generates perceptual hashes for fuzzy matching. Integrity checks and perceptual hashing are skipped for files over 500 MB; the file is still hashed and signed.
2. Choose metadata - Set content rights, AI disclosure, contact preferences, and an optional Public Note. Shared metadata applies to all files in a batch.
3. Sign - Vault signs each hash with your Ed25519 key and commits it to your local Holochain conductor. The key never leaves your device.
4. Publish - Signatures gossip to Flowsta's tamper-proof network automatically. Verifiable by anyone, typically within minutes.

When a third-party app requests a signature, the same rule holds: Vault shows you an approval dialog for every signature - the app name (or the requesting page's origin), the file label, and the first characters of the hash. When the signature will be published to the network, the dialog also says whose quota pays - your own, or the app's sponsored pool. The dialog does not show the license, AI disclosure or intent the app supplied. Nothing is signed without your explicit yes.

Verify

1. Go to flowsta.com/sign-it/verify - Drop the file, or click Choose File.
2. Exact match - SHA-256 hash lookup on the network. For this step the file never leaves your browser.
3. Fuzzy match - When there is no exact match, images, audio and video are sent to the server for perceptual fingerprinting and discarded. This finds re-encoded, resized, or trimmed versions.
4. Results - See all signers, when they signed, their content rights, AI disclosure, Public Notes, and revocation status.

Verification is free on every plan. The public API is rate-limited per IP address.

Key Features

Batch Signing

Sign multiple files at once in Vault - drop a folder or select multiple files. Each file gets its own independently verifiable signature, while shared metadata (license, AI policy, Public Note) applies to the whole batch.

Content Rights Manifest

Attach a machine-readable rights declaration to your signature:

• License - All Rights Reserved, CC0, CC BY, CC BY-SA, CC BY-NC, CC BY-NC-SA, MIT, Apache 2.0, GPL 3.0. The network also accepts a custom license string (up to 128 characters); the Vault does not offer it, so you will only meet it in records made by other apps.
• Commercial Licensing - Whether you're open to licensing inquiries
• AI Training Policy - Allowed, allowed with attribution, requires license, not allowed
• Contact Preference - Whether verifiers can contact you (via blind relay - your email is never exposed)

Public Note

Add a signer comment of up to 280 characters - context, dedication, terms, anything you want verifiers to see alongside your signature.

AI Generation Disclosure

Declare whether the content was made with AI. The Vault offers three choices (plus "Not declared"):

Vault label	On the network	Meaning
No AI	None	Human-created, no AI involvement
Part AI Generated	Assisted	Partly AI-generated
AI Generated	Generated	Fully AI-generated

Perceptual Hashing (Fuzzy Matching)

Signatures include perceptual hashes that survive common transformations:

Media Type	Algorithm	hash_type on the network	Survives
Images (PNG, JPEG, BMP, TIFF, GIF)	Gradient dHash (64 bits)	ImagePHash	Resize, recompress, color change
Audio (MP3, WAV, FLAC, OGG)	Chromaprint fingerprint	AudioChromaprint	Re-encode, resample, compression, trim
Video (MP4, MKV, AVI, WebM)	Audio track Chromaprint	VideoPHash	Re-encode, resize, trim

File Integrity Analysis

Before signing, Vault checks your file for hidden content:

• Post-EOF data (data appended after file end markers)
• LSB steganography (statistical analysis of pixel values - PNG, BMP and TIFF images)
• Unicode steganography (zero-width characters, homoglyphs - text-like files)
• Metadata anomalies (suspicious PNG chunks, JPEG comments, PDF JavaScript)
• Entropy analysis (regions of unusual randomness)
• Appended file detection (embedded files within files)

Results are recorded in the signature. The Vault shows them before you sign; the web verify page does not display them yet.

Multi-Signer Support

Multiple people can sign the same file hash. Useful for contracts (all parties sign), approvals (multiple approvers), and attestations (witnesses).

Revocation

Signers can revoke their own signatures. The original record stays on the network but is marked as revoked with a timestamp and optional reason.

What a signature record holds

Being on the network is what makes a signature checkable by anyone, so it is worth being exact about what is there and what is not.

On Flowsta's tamper-proof network, signed by the signer's key, readable by anyone:

• the file's SHA-256 hash and the Ed25519 signature over it
• the signer's agent public key (the permanent ID is derived from it) and the time
• the intent, if declared: Authorship, Approval, Witness, Receipt or Agreement (the Vault always records Authorship)
• the AI disclosure, if declared: None, Assisted or Generated
• the content rights, each optional: license, commercial licensing, AI training policy, contact preference
• the integrity report from signing (metadata, hidden data, appended files) and the perceptual hash, both computed by the signer's own app at signing time and committed as the signer's claims
• the edit chain (which earlier record this one replaces), an optional expiry, up to 5 tags of 32 characters, and the public note of up to 280 characters (the Vault sets no expiry or tags today)
• beside it: the signer's thumbnail (square as the Vault makes it; the network itself enforces only the data:image/ form and the 15 KB cap) and any revocation, with its time and reason

Not on the network: the file itself, and the file's name. Sign It signs a hash. The name of a file you drop on the verify page is your file's name, not the record's. The display name, username and picture shown next to a signature are Flowsta's record of who holds that key, kept off the public network on purpose because they identify a person.

Two consequences for anything you build on this:

• A thumbnail is the signer's preview, not evidence of the file's content. The hash is the evidence.
• "Verified" on the verify page means: the file's hash matches a record on the network, made by that key, not revoked.

For Developers

Third-party apps request signatures through the user's Vault. Your app never touches keys - the user approves each signature in a Vault dialog. What your app gets back depends on how it talks to the Vault:

• A Holochain app linked to the person's identity (@flowsta/holochain 3.6.0+, linked through linkFlowstaIdentity) asks the Vault to publish the signature to the Sign It network from the person's own device. Anyone can then verify the file.
• A web app (@flowsta/auth) gets a signature the Vault made for it and returns to the app. It is not on the network, so nobody else can verify the file by it. People publish from their own Vault's Sign It page.

import { signDocument } from '@flowsta/holochain';

// A linked app: publishes from the person's device by default
const result = await signDocument({
  clientId: 'your_client_id',
  appName: 'ArtStudio',
  fileHash: hash,                       // SHA-256 hex, 64 characters
  label: 'Illustration.png',            // shown in the Vault dialog
  intent: 'authorship',
  contentRights: { license: 'cc-by', aiTraining: 'not_allowed' },
});

if (result.published) {
  console.log('On the network:', result.actionHash);
}

Published signatures made through your app are sponsored when your organization has a signing plan: they draw from your organization's monthly signing pool, not the user's personal quota - and the Vault dialog tells the user so. See Signing quotas & sponsored signing.

See the Developer Guide for full integration instructions.

Architecture

Sign It uses a dedicated Holochain signing DNA separate from the identity and private DNAs. This provides:

• Privacy separation from identity profiles
• Independent iteration without identity DNA migrations
• Optimized file-hash lookups and perceptual hash band queries

The signing DNA runs on your local Vault conductor and on Flowsta's network nodes. Your Vault commits the signature locally; it then gossips to the rest of the network - typically verifiable everywhere within minutes. Signatures from all your linked devices appear in one signatures list, stitched together through Holochain agent linking - no central server required.

Next Steps

• Quickstart - Sign your first file
• Content Rights - Detailed rights manifest guide
• Developer Guide - Vault signing for third-party apps, quotas, sponsored signing
• Verification API - Programmatic file verification
• SDK Reference - All SDK methods for signing and verification