--- title: "Document digests, an owner-signed record, and registry readings that say when and from what they were read: Trooth changelog - Trooth" description: "A Trust Center document now carries a SHA-256, computed from the uploaded file or stated by the company; a certification can carry the digest of a private report and a link to the auditor's signed statement; a company can name the version of its record in its domain-signed declaration; each state registry entry in the public record names when it was read and the digest of the file or answer it came from." canonical_url: "https://trooth.co/changelog/2026-10-15-document-digests-and-owner-signed-record" markdown_url: "https://trooth.co/changelog/2026-10-15-document-digests-and-owner-signed-record.md" generated_from: "the rendered page, converted to Markdown when this was requested" agent_index: "https://trooth.co/llms.txt" --- [Back to changelog](https://trooth.co/changelog) New October 15, 20262 minute read # Document digests, an owner-signed record, and registry readings that say when and from what they were read A Trust Center document now carries a SHA-256, computed from the uploaded file or stated by the company; a certification can carry the digest of a private report and a link to the auditor's signed statement; a company can name the version of its record in its domain-signed declaration; each state registry entry in the public record names when it was read and the digest of the file or answer it came from. ## What changed Trust Center documents: a file uploaded to the Evidence Vault is hashed with SHA-256 when it arrives, and a document published from it shows that digest, labeled as computed by Trooth from the uploaded file; a document published by URL can carry a digest the company states, labeled as stated by the company. A certificate of insurance can be published as a document, and the procurement row names it with its digest. Certifications: a company can publish the SHA-256 of a private report, a link to the auditor's signed statement and that statement's digest; the public page says Trooth has not read the report and has not checked the digest. Owner-signed record: the declaration format gains record_version and record_digest, taken from the headers of the record application programming interface (API); the public record shows whether the signed version is the one published now or has been superseded, as the company's statement made with its own key. Registry readings: entries from New York, Colorado, Connecticut, Oregon and Florida carry read_at and sha256, and a Florida entry names the state file it came from; the Florida copy says how many working days behind the state's newest file it is when that passes five. ## Why it changed A buyer who receives a report under a non-disclosure agreement (NDA) can hash it and check the result against the published digest; a reader of the public record can tell which state file an entry came from; and a company can name the published version of its record with its own key. None of this is a statement by Trooth about the document: each digest and binding is labeled as the company's. ## Who is affected - **Affected:** Companies publishing documents or certifications, buyers reading them, developers reading the public record or the declaration format, and users of the trooth command line, which is version 0.21.0. - **Availability:** Everyone. The new fields are optional; a record or document without them reads as before. - **Release stage:** Available. - **Areas:** Trust Profiles, Network, API, CLI, Company workspace. ## What to do **No action required.** Nothing anyone builds on changed. To bind your record, run trooth declare sign --record --bind-record with version 0.21.0 and publish the signed declaration at /.well-known/trooth.json on your domain; sign again after you publish a new version. ## Versions and migration - **trooth:** `0.21.0` ## Dates - **Announced:** October 15, 2026, the day this entry was written. Entries are never backdated. - **Released:** October 15, 2026. ## Read more - [Declarations in the command line](https://trooth.co/docs/cli#declare) - [Public Trust Profile API](https://trooth.co/docs/trust-profile-api) On this page - What changed - Why it changed - Who is affected - What to do - Versions and migration - Dates - Read more [New](https://trooth.co/changelog?type=new)[Trust Profiles](https://trooth.co/changelog?area=trust-profile)[Network](https://trooth.co/changelog?area=network)[API](https://trooth.co/changelog?area=api)[CLI](https://trooth.co/changelog?area=cli)[Company workspace](https://trooth.co/changelog?area=workspace) [Back to changelog](https://trooth.co/changelog) ## Related changes - [OCT.15DeprecationThe compare pages and the compare tool are withdrawnNetwork +3](https://trooth.co/changelog/2026-10-15-compare-withdrawn) - [OCT.12DeprecationThe older profile lookup and the version 1 webhook signature retire on April 30, 2027API +4](https://trooth.co/changelog/2026-10-12-legacy-lookup-and-v1-signature-retire) - [OCT.07NewTrooth command-line tool 0.14.0: a company's own signed declaration, and the proof behind each tie in the public recordCLI +1](https://trooth.co/changelog/2026-10-07-cli-0-14-0-declarations) - [OCT.07NewTrooth command-line tool 0.13.0: the guard for agent actions, and what each public record reading rests onCLI +1](https://trooth.co/changelog/2026-10-07-cli-0-13-0-guard) - [OCT.07NewTrooth command-line tool 0.12.0: MCP tool fingerprints, more of the public record, and a hardware key for the logCLI +1](https://trooth.co/changelog/2026-10-07-cli-0-12-0-mcp-tools) - [OCT.07NewTrooth command-line tool 0.11.0: witnesses for the log, and a signed public recordCLI +1](https://trooth.co/changelog/2026-10-07-cli-0-11-0-witnesses) ## Follow what changes at Trooth Every entry by email, or a feed narrowed to one area or to the changes that need you to act. ## Product updates by email Occasional notes when something on this page changes. You get one confirmation email when you subscribe, every email carries an unsubscribe link, and the address is never sold or shared. Email address [RSS](https://trooth.co/changelog/rss.xml)[Trust Profiles only](https://trooth.co/changelog/rss.xml?area=trust-profile)[Needs action](https://trooth.co/changelog/rss.xml?action=required) ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://trooth.co/#org", "name": "Trooth", "legalName": "Trooth, LLC", "alternateName": [ "Trooth, LLC", "Trooth Network", "trooth.co" ], "url": "https://trooth.co", "logo": { "@type": "ImageObject", "@id": "https://trooth.co/#logo", "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "width": 1024, "height": 1024, "caption": "Trooth" }, "image": { "@id": "https://trooth.co/#logo" }, "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.", "foundingDate": "2025-12-16", "address": { "@type": "PostalAddress", "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174", "addressLocality": "Miami", "addressRegion": "FL", "postalCode": "33131", "addressCountry": "US" }, "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "hello@trooth.co", "url": "https://trooth.co/contact" }, "sameAs": [ "https://x.com/Troothllc", "https://github.com/troothllc", "https://www.crunchbase.com/organization/trooth", "https://www.wikidata.org/wiki/Q141292994", "https://www.youtube.com/@Troothllc", "https://www.trustpilot.com/review/trooth.co" ] }, { "@type": "WebSite", "@id": "https://trooth.co/#website", "url": "https://trooth.co", "name": "Trooth", "alternateName": "Trooth Network", "inLanguage": "en", "publisher": { "@id": "https://trooth.co/#org" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://trooth.co/network?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "ItemList", "@id": "https://trooth.co/#sitelinks", "name": "Trooth sitelinks", "itemListElement": [ { "@type": "SiteNavigationElement", "position": 1, "name": "Join Trooth for free", "url": "https://trooth.co/signup" }, { "@type": "SiteNavigationElement", "position": 2, "name": "Company, Trooth", "url": "https://trooth.co/network/company/trooth" }, { "@type": "SiteNavigationElement", "position": 3, "name": "Trooth Network", "url": "https://trooth.co/network" } ] } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trooth.co/" }, { "@type": "ListItem", "position": 2, "name": "Changelog", "item": "https://trooth.co/changelog" }, { "@type": "ListItem", "position": 3, "name": "Document digests, an owner-signed record, and registry readings that say when and from what they were read", "item": "https://trooth.co/changelog/2026-10-15-document-digests-and-owner-signed-record" } ] } ```