Trust & verification
Don’t trust us. Check us.
Thonest is only worth anything if you don’t have to take our word for it. This page explains exactly what is checked, how, and — just as important — what none of it proves.
The standard we hold ourselves to
If Thonest ever cheated, someone who dislikes us — with no special access — should be able to prove it.
Not “trust our team.” Not even “trust the blockchain.” The goal is to make dishonesty detectable by hostile strangers. Everything below serves that.
Before a record is accepted — checked against the source, not by a moderator
We don’t have moderators approving records for accuracy. A human deciding what counts as accurate would reintroduce exactly the editorial judgment this project exists to avoid — and moderators can be biased, captured, or simply wrong. The source is the authority instead.
Check 1
We retrieve the source from the platform itself
Where a platform publishes an unauthenticated endpoint, we use it: X and TikTok both return a post’s own text straight from their servers. Otherwise we fetch the page and read its content and metadata. That response is stored verbatim, hashed, and published — you can read the raw bytes we received.
Check 2
The quote must actually appear in that response
The submitted wording is matched against what the platform returned. Not “does this look right” — literal containment, after folding away typography (curly quotes, dash variants, spacing) so a record isn’t rejected over an apostrophe. If the quote isn’t in the source, the submission is refused. A fabricated quote attached to a real link cannot be published, and no reviewer is the thing standing in the way.
Check 3
The platform tells us who published it — not the submitter
X states which account a post belongs to. We read the account from their response and bind it to the speaker. Submitting a real post while attributing it to a different person is refused. Every record shows the account the platform reported.
What the check can conclude
| Status | Meaning |
|---|---|
| Verified | Found word-for-word in the platform’s own response |
| Partial | Most of the quote is present in order; wording may have been trimmed — flagged for a closer look |
| Rejected | The source was retrieved and the quote is not in it — never published |
| Attested | No machine-readable source (video, audio, paywall). The wording rests on the submitter and the original link, and the record says so |
After a record is accepted — made tamper-evident
Layer 1
An independent archive, when one can be had
We ask the Internet Archive to save the source, and store their URL and their timestamp — so you can check a copy on a server we don’t control.
This often doesn’t work, and that matters. Some platforms — X and Facebook among them — block archiving services outright. Beyond that, the Internet Archive rate-limits, times out, and has outages, so an attempt can simply fail on a source that would otherwise archive fine. A record showing no independent copy therefore means either “this platform refuses archiving” or “the attempt didn’t succeed” — the record says which, and we retry the failures daily. It never implies corroboration it doesn’t have.
It is also worth saying plainly: the Internet Archive is a single organization. If it disappeared, the copies it holds would go with it. That is a real dependency, and it is why the archive is one layer among several rather than the foundation.
Layer 2
Fingerprinting and batching
The record, its source, the stored platform response and the verification result are hashed together with SHA-256. A hash is a fingerprint: identical input always gives the identical result, and changing one character changes it completely. Those fingerprints become leaves in a Merkle tree, which reduces a whole batch to a single root — while still letting you prove one specific record belongs to it.
Layer 3
The root goes onto a public blockchain
That root is written into a transaction on Base, a public Ethereum layer-2. Thousands of independent computers hold copies; nobody, including us, can quietly change what was written. Records are anchored the moment they are locked. The content stays off-chain — only the fingerprint is published. We run no blockchain of our own and there is no token: a chain only we controlled would prove nothing.
Layer 4
The blockchain enforces the chain — it isn’t just our word
Every batch commits to the previous batch’s root, and the full list of fingerprints in each batch is published. Deleting or editing an old record changes its batch root, which breaks every batch after it. This is the design web browsers use to keep certificate authorities honest.
Until recently that link was recorded by us rather than enforced: we published a hash and our own database claimed batch N followed batch N−1. Batches are now appended through a small contract that rejects any batch not following the previous one, and that has no function to edit or delete a batch — none, for anyone, including us. Losing our key would freeze the log rather than let it be rewritten, which is the safe failure.
Layer 5
Every batch commits to the whole archive, so quiet deletions are provable
The fairest criticism of a project like this is that we could simply drop records we don’t like. So every anchor batch also commits to a digest of every record in the archive at that moment — a hash over each record’s id and evidence fingerprint.
That manifest — every record id, its evidence fingerprint, the digest, and the method to recompute it — is published at /api/v1/export and needs no key, no account, and no permission from us. Keep a copy. If a record later disappears, your copy and the digest committed onchain stop agreeing with ours — provably, without our cooperation.
This protection only exists if people actually keep copies. We can publish the manifest and commit the digest, but we cannot make anyone download it — and a proof nobody holds the other half of is just a promise. If you care whether this registry stays honest, mirror it.
Two different promises, kept separately. “You can verify we never rewrote history” is unconditional, anonymous and permanent — that is the manifest above, and it is all the argument on this page rests on. “You can download the entire corpus in bulk” is a different thing: record text, sources, the entity graph and resolution data are licensed, because that dataset is the business. Every individual record stays publicly inspectable and independently verifiable at /api/v1/records/{id} — you never need our permission to audit any record you can see.
We would rather say this plainly than let “open export” imply something we intend to change later. What you can check without trusting us has not been reduced.
When we get it wrong
Anyone can dispute a record or a resolution, and the person a record is about gets a priority lane. We commit to acknowledging a dispute within 72 hours and resolving it or posting a status within 14 days.
That a dispute exists is public the moment it is filed. The outcome is appended to the record’s permanent history and anchored — including when it goes against us. The original record is never edited; you can always see what we said before, what changed, and why. The full process is in the methodology.
How you check it yourself
The verify page recomputes a record’s root from its published proof in your browser, then reads the anchored root directly from a public Base node — not from our API. If those match, the record is byte-for-byte what was committed. If we had altered it, the check would fail. The page also prints the raw command to do the same thing from your own terminal, so you don’t have to trust the page either.
What each layer proves — and doesn’t
| Layer | Proves | Does not prove |
|---|---|---|
| Quote verification | The wording appears in what the platform returned | That the statement is true, or that the account is authentic |
| Identity binding | Which account the platform says published it | That the account belongs to the person it claims to |
| Platform capture | What the platform served us, kept verbatim | Anything, if the platform itself is wrong or spoofed |
| Independent archive | The content was at that URL, per an outside party | That our archive is complete |
| Anchoring | The record existed in this form by this block, unchanged since | That the speaker said it, or that the date is real |
| Batch chaining | Nothing was retroactively removed or edited | That we published everything we received |
The honest limits
- We do not take screenshots, and you should be sceptical of anyone who says they do. A screenshot taken by us would be our own image, provable by nothing. Worse, the platforms that most need it defeat it: X serves a login wall to anyone not signed in, so an automated screenshot of a post captures the login wall, not the post. It would look like evidence while being worthless. We store the platform’s own machine-readable response instead, which is harder to fake and can be checked byte-for-byte.
- Cryptography cannot prove authorship. No hash or blockchain establishes that a person said something. That rests on the source, its independent archive, and the platform’s own attribution. The strongest version arrives when public figures sign their own records with their own keys.
- Video and audio are not verified. No platform exposes transcripts, so a spoken quote rests on the submitter and the original link. Those records are marked attested and are weaker than a verified one. Say so when you cite them.
- Anchoring proves capture time, not statement time. A record added today can describe a 2019 statement; the blockchain only attests to when we recorded it. Both dates are always shown separately.
- Independent archiving frequently fails, and the completeness proof needs volunteers. Archivers get blocked, rate-limited and time out, so many records carry weaker provenance than we would like — the record always says which. And the guarantee that we haven’t deleted anything only binds if third parties actually hold copies of the manifest. Both of these depend on people and organizations outside our control, which is precisely what makes them worth something.
- We are one small operator. No external auditor reviews this, disputes are resolved by us, and there is no independent reviewer pool yet. The checks above are designed so that you don’t have to take our word for it — but the governance around them is young, and you should weigh it accordingly.
- We can be wrong. So the original record is never edited: disputes, added context and revised resolutions are appended and stay visible. A system claiming it never errs would deserve less trust, not more.
What we will never say
“The blockchain proves this is true.” It doesn’t, and any claim like it should make you trust a project less. The whole thing in one line:
Provenance is where it came from. Anchoring is that it hasn’t changed. Neither decides what’s true — that’s your job, with the evidence in front of you.
Not built yet
We’d rather list this than let you assume otherwise. Outcome Subject signing for self-recorded statements does not exist. There is no named external reviewer pool — disputes are handled by us. Nobody independent is yet known to mirror the manifest, and no archival custodian yet holds a full-content copy — so today the proof outlives us, but the underlying record would not. Building that custodian arrangement is outstanding work, not a capability we have. Automatic settlement covers only a small set of allowlisted metrics; every other record carries a locked test that a person has to read, and says so on its face.
One thing that used to be on this list is not any more. Records were anchored to Base’s test network during the prototype, which has no economic security. Since 18 August 2026 they are anchored to Base mainnet, and the registry contract was deployed there with a clean genesis — so every record Thonest has ever held has been anchored to a network that cannot be reset. Nothing was carried over from the testnet era, because there was nothing worth carrying: the archive was empty when the switch was made.