A Trust Center document now carries a SHA-256, computed from the uploaded file or stated by the company; a certification can carry the digest of a private report and a link to the auditor's signed statement; a company can name the version of its record in its domain-signed declaration; each state registry entry in the public record names when it was read and the digest of the file or answer it came from.
What changed
Trust Center documents: a file uploaded to the Evidence Vault is hashed with SHA-256 when it arrives, and a document published from it shows that digest, labeled as computed by Trooth from the uploaded file; a document published by URL can carry a digest the company states, labeled as stated by the company. A certificate of insurance can be published as a document, and the procurement row names it with its digest. Certifications: a company can publish the SHA-256 of a private report, a link to the auditor's signed statement and that statement's digest; the public page says Trooth has not read the report and has not checked the digest. Owner-signed record: the declaration format gains record_version and record_digest, taken from the headers of the record application programming interface (API); the public record shows whether the signed version is the one published now or has been superseded, as the company's statement made with its own key. Registry readings: entries from New York, Colorado, Connecticut, Oregon and Florida carry read_at and sha256, and a Florida entry names the state file it came from; the Florida copy says how many working days behind the state's newest file it is when that passes five.
Why it changed
A buyer who receives a report under a non-disclosure agreement (NDA) can hash it and check the result against the published digest; a reader of the public record can tell which state file an entry came from; and a company can name the published version of its record with its own key. None of this is a statement by Trooth about the document: each digest and binding is labeled as the company's.
Who is affected
- Affected: Companies publishing documents or certifications, buyers reading them, developers reading the public record or the declaration format, and users of the trooth command line, which is version 0.21.0.
- Availability: Everyone. The new fields are optional; a record or document without them reads as before.
- Release stage: Available.
- Areas: Trust Profiles, Network, API, CLI, Company workspace.
What to do
No action required. Nothing anyone builds on changed. To bind your record, run trooth declare sign --record <your record URL> --bind-record with version 0.21.0 and publish the signed declaration at /.well-known/trooth.json on your domain; sign again after you publish a new version.
Versions and migration
- trooth:
0.21.0
Dates
- Announced: October 15, 2026, the day this entry was written. Entries are never backdated.
- Released: October 15, 2026.