A degree that
proves itself.
Digital credentials for universities — open, decentralised and independently verifiable. A verifier checks the document against a public network in seconds. No call to the registrar. No licence fees.
Open Elements · Built on open standards · Source code open and self-hostable
- Open source
- Self-hostable
- GDPR-compatible
- No licence fees
Why it holds
Four properties, all of them structural.
Independently verifiable
A verifier checks the credential against a public network, not against us. No account, no middleman, under ten seconds.
Outlives every operator
Public anchor, standard formats, open source. Cancel the contract and you lose the support, not your credentials.
Revocation that arrives
A withdrawn degree reads “revoked” on every future check — including on a PDF that has circulated for years.
No personal data published
Only a fingerprint, a reference ID, an event type, the issuer and a timestamp. The document never leaves your systems.
The problem
Today, a degree is a PDF file.
A certificate is paper or a PDF, a seal and a signature. All of that could always be forged — it was simply slow, expensive and required real craft. That craft has disappeared: a convincing certificate with the right layout, seal and letterhead now takes minutes, for a few euros, with no skill at all.
The verification side has not moved at all: call, look, hope. Whoever checks a certificate can only believe the university they call — or the number printed on the forged document.
1 in 16
documents submitted for review is flagged as fraudulent (6%).
Inscribe, Document Fraud Report 2026
+244%
year-over-year increase in digital document forgeries.
Entrust Identity Fraud Report
5×
more AI-generated document fraud between April and December 2025.
Inscribe, Document Fraud Report 2026
7,600
fake nursing diplomas from three schools in a single case — untrained people in patient care.
“Operation Nightingale”, US Department of Justice
The status quo
Three answers — and why none of them holds.
Manual verification
A call to the registrar, a visual check, seals and watermarks. It checks exactly the features generative models now reproduce reliably — and it does not scale beyond a single cohort.
AI forgery detection
Spots artefacts and anomalies in files and layouts. Reactive by design: trained on yesterday's fakes. An arms race in which the defender is structurally behind.
A central verification portal
The university or a vendor runs a database. It only moves the problem: whoever controls the database controls the truth. If the operator disappears, the credential disappears with it.
The answer
A credential has to prove itself.
Verifiable independently of whoever issued it and whoever runs the software. Integrity, revocation, longevity and independent verifiability — take those four requirements seriously and you inevitably arrive at a trust anchor that belongs to none of the parties involved.
| University portal | A SaaS vendor | ProofLayer | |
|---|---|---|---|
| Verifiable without trusting the operator | No | No | Yes |
| Survives shutdown, insolvency, vendor change | Partly | No | Yes |
| Insider manipulation | Possible | Possible | Immediately visible |
| Verification without account or middleman | No | No | Yes |
| Can you run it yourself | Yes | No | Yes |
Trust owned by a single party is not trust — it is a dependency.
How it works
Four steps, and the proof travels with the document.
ProofLayer does not replace how you issue certificates. It attaches a proof to the document that anyone can check, anywhere, without asking you first.
- 01
Issue
The university issues the credential in ProofLayer — through the interface or straight from the campus system via API.
- 02
Anchor
A SHA-256 fingerprint is computed from the document and written to the public network with a timestamp.
- 03
Hand over
The graduate receives a PDF with a QR code — and, once available, the same credential in their EUDI wallet.
- 04
Verify
The verifier scans the QR code. Result in seconds: authentic, unaltered, not revoked — or not.
The decisive point: the QR code carries the proof coordinates itself. Whoever verifies queries a public node of the network directly — no ProofLayer account, no call to the registrar, no middleman. The credential checks itself against the network, not against us.
Under ten seconds per check. And nobody learns who verified what, or when.
Contact us for a demo
See issuance and verification on a real certificate — 30 minutes.
Why it cannot be forged
The fingerprint.
A calculation turns any document into a fixed character string. The same document always yields the same string — a changed document always a different one. The certificate cannot be reconstructed from the string, which is why anchoring it raises no data-protection concerns.
Original
Diploma · Anna Sample · M.Sc. · Grade 1.3
a23bba54 23767f49 fd8184ed f2f1de5a e6f09e4f 078bb320 7ac6338a 0577cc9d
One digit changed
Diploma · Anna Sample · M.Sc. · Grade 1.0
75ae25f4 75e2f027 96efeac5 4b2f5358 d6c76ae6 9ab1c2ab 3cda9411 71d7edca
Not reversible
No personal data can be read back out of the string.
Unique
Two different documents never produce the same string.
Sensitive
One changed comma and the string is completely different.
The difference in practice
What this changes on an ordinary Tuesday.
Revocation that actually arrives
When a degree is withdrawn — plagiarism, deception, retraction — ProofLayer writes a revocation event to the network. From that moment every check reads “revoked”, including a check on a PDF that has been circulating for years and whose copy you will never get back. No circular letter, no recall, no tracking required.
Selective disclosure
With SD-JWT credentials the graduate decides which claims to reveal. An employer can confirm that the degree exists, the institution is genuine and nothing was revoked — without seeing a date of birth, grades or a student number. Data minimisation here is not a promise, it is the architecture.
Data protection
What goes on the network — and what never does.
Anchoring a credential does not mean publishing it. The network sees a fingerprint and nothing else; the document and every personal detail in it stay in your systems.
Always stays with you
- Name, address, email
- Student number
- Grades and examination records
- The certificate PDF itself
- All personal data
Goes on the public network
- SHA-256 fingerprint of the document
- Public reference ID (no personal link)
- Event type: issued / revoked
- Identifier of the issuing institution
- Consensus timestamp
The fingerprint proves that a particular document exists and is unaltered — without revealing what it says. That is what makes the anchoring privacy-preserving and GDPR-compatible: no personal data in an immutable store.
By construction, not by policy
Three properties you do not have to take on trust.
No personal data in an immutable store
Nothing that identifies a graduate is ever written to the network, so there is nothing to erase from it later. The right to erasure applies to your own systems, where it can actually be exercised.
Verification leaves no trail
A verifier queries a public node directly. Neither ProofLayer nor the university learns who checked which credential, or when — there is no verification log to subpoena or leak.
Minimum disclosure by default
SD-JWT credentials let the graduate reveal single claims instead of a whole document. An employer can confirm the degree without seeing a date of birth, a grade or a student number.
The foundation
The anchor: a network nobody owns.
ProofLayer anchors credentials on Hedera — a public, distributed network whose nodes are run by more than 30 independent organisations, among them Google, IBM, Deutsche Telekom, the London Stock Exchange and EDF. None of them can alter or delete an entry after the fact — and neither can Open Elements.
ABFT consensus
The highest security class for distributed consensus. Finality in seconds, no later reversal.
Fixed price per entry
About USD 0.0001, denominated in USD and independent of any token price. No gas auctions, no price spikes.
Open-source foundation
The code is open source as Hiero under the Linux Foundation. A university consortium could eventually run a network of its own.
Nodes run by independent organisations
- IBM
- Deutsche Telekom
- London Stock Exchange Group
- EDF
A selection of the more than 30 organisations operating consensus nodes. No single one of them — and no vendor — can rewrite what has been written.
Why not a plain database
Because a database has an owner.
A signature alone is not enough
A cryptographic signature proves who signed. It cannot prove that the credential has not since been revoked, and it stops being checkable the day the signing key expires or the issuing key material is lost.
A registry can be rewritten
Whoever administers a registry can add, change or remove rows, and can be compelled to. On a public network with independent nodes, an entry that exists stays visible — including to the institution that wrote it.
An operator can disappear
Vendors are acquired, budgets end, institutions merge. The anchor has to outlive all of that, which is only possible if it is not run by any of the parties with an interest in the outcome.
Anchored on the Hedera network · built from the open-source Hiero codebase at Linux Foundation Decentralized Trust
Interoperability
Open standards, not an island.
We do not invent a format of our own. ProofLayer builds entirely on the standards the EU is aligning its digital identity around — so your credentials stay verifiable even if ProofLayer is no longer in the picture.
OID4VCI
Issuing credentials into any compatible wallet.
OID4VP
Presentation and verification straight from the holder's wallet.
SD-JWT VC
Primary format — signed and selectively disclosable.
W3C VC
Interoperability layer for exchange with third parties.
Status List
Standardised revocation and suspension checks.
DIDs
Decentralised identifiers for issuers and institutions.
Trust domains
Two routes to being trusted.
In production · did:hedera
Self-sovereign domain
Your own trust registry, your own anchor. No gatekeeper, no accreditation required — for closed ecosystems and markets outside the EU framework. In use today with education providers in Africa, where credential fraud is an acute problem.
In progress · did:ebsi / EUDI
European domain
Accreditation along the Root TAO → TAO → Trusted Issuer chain, embedded in eIDAS 2.0, connecting to European Digital Credentials for Learning. The right route for European universities.
With did:hedera you own the trust anchor. With did:ebsi you are accredited into someone else's trust. The choice follows the target market, not the technology.
For IT departments and providers
A layer, not a replacement.
ProofLayer replaces no campus management system and no examination administration. It adds exactly what they cannot do: a credential that stays verifiable outside your systems. Containerised, with PostgreSQL and object storage — in your own data centre, at a regional provider, or with us.
Single sign-on
OIDC or SAML against your existing identity management — Shibboleth/eduGAIN, Keycloak, Entra ID. No second user directory.
REST API
Every function of the interface is available as an API: issue, revoke, query status, verify. Documented with OpenAPI.
Webhooks
ProofLayer pushes events back to you — issued, anchored, claimed, revoked. Your system does not have to poll.
Bulk issuance
A whole graduating cohort in a single run, by file import or API — not record by record.
Roles & tenants
Permissions separated by institution, faculty and role. One deployment, many universities — with no data bleeding across.
Keys stay in the backend
Private keys never leave the backend. The frontend sends no network transactions and holds no key material.
Where it runs
Your data centre, a regional provider, or ours.
Self-hosted
Pull the containers, bring a PostgreSQL instance and object storage, and run it entirely inside your own infrastructure. The source code is open, so nothing is opaque to your operations team.
Regional provider
The same containers at a hosting partner of your choice — useful where procurement requires a specific jurisdiction or an existing framework contract.
Operated by us
We run the deployment under a Support & Care agreement, with agreed response times and security updates. You can move it in-house later without reissuing a single credential.
The business model
All open source. No licence fees.
There is no per-seat price, no per-credential price and no charge for verifications. Two things cost money, and neither of them is permission to use the software.
Costs nothing
- The entire source code — inspectable and self-hostable
- Usage itself: no licence, no seats, no maintenance fee
- The number of credentials you issue
- The number of verifications
- Verifiers need no account and no contract
- Leaving us — any time, without reissuing anything
Costs money
Network fees of about USD 0.0001 per event. You pay that to the network, not to us. At 5,000 graduates a year, that is under one euro.
Support & Care optional. You pay for people and commitments — operations, integration, security updates, advice, response times. Not for permission to use the software.
If we want to keep you, we have to be good — not be your licensor.
A worked example
What a graduating cohort costs.
Network fees are denominated in USD and independent of any token price, so this figure does not move with a market.
- Graduates per year
- 5,000
- Network events (issue + revoke headroom)
- ~5,100
- Fee per event
- USD 0.0001
- Licence fees
- None
- Verification fees
- None
Total network cost per year
under EUR 1
Who builds it
We help build the technology this rests on.
ProofLayer is not a reseller product on top of somebody else’s stack. The people building it sit in the technical bodies of the open-source projects it depends on.
Technical Steering Committee Chair, Hiero
Hendrik Ebbers chairs the highest technical body of the open-source project the Hedera network is built from.
Vice Chair, LFDT Technical Advisory Board
A seat in the body that sets the Linux Foundation's technical roadmap for decentralised trust technologies.
Eclipse Foundation, Board of Directors
A board seat at Europe's largest open-source foundation, and founding member of Eclipse Adoptium — the project behind Temurin.
Maintainers, not resellers
We maintain Apache Maven, JUnit, Apache Log4j, Apache Commons and Eclipse Temurin — in the code itself, not as a support layer on top.
Publicly funded and vetted
Germany's Sovereign Tech Agency funds our work on Apache Maven. We are one of two providers authorised to supply hardened containers to the German federal administration.
Founding member of the ORC WG
We work on the practical implementation of the Cyber Resilience Act for open source — with foundations, industry and EU representatives.
Why that matters here
The people who maintain a foundation can be held to it.
A credential has to stay verifiable for decades. That is only credible if the layers underneath it are maintained in public, by people who are accountable in those projects — and if the code you run is code you could keep running without us.
Questions
What registrars and IT ask first.
Something we have not answered?
Write to us with the specifics of your institution and we will answer in writing — no call required.
motseki.khoarai@open-elements.comThe next step
What a pilot actually looks like.
No procurement marathon and no platform decision up front. One degree programme, on the test network, with no production data — and a decision at the end that is based on figures rather than a slide deck.
Phase 1 · 4–6 weeks
Test network
One degree programme, one credential type. Issuance and verification run end to end — on the test network, no production data, no risk.
Phase 2 · one semester
Production
Your own network account, issuer identity and event channel. A regular graduating cohort, real verifications by third parties.
Phase 3 · ongoing
Roll-out
EUDI wallet integration and further credential types: micro-credentials, certificates of attendance, internship and continuing-education records.
What we need
- One contact person from the registrar or IT
- One well-scoped degree programme to start with
- A sample certificate and the existing issuance process
What you get
- A working installation and support while you set it up
- Verifiable credentials that stay valid after the pilot
- Solid figures on effort, cost and data protection
Trust is not claimed.
It is calculated.
Let us take one degree programme and show you. Four to six weeks, on the test network, with no production data.
Motseki Khoarai
Team Lead, Open Elements
