Proof They
Read It.
Send messages with cryptographic proof of delivery and reading. Get tamper-proof receipts, a protected viewer that blocks screenshots, and verifiable evidence the message was opened.
Send. Arrive. View. Prove.
Four steps captured in the app — from composing a certified message to receiving cryptographic proof that it was read.
Certified Message
Arrived
When a certified message lands, the recipient sees all the certification details — delivery proof, protected file status, and a direct link to view the Proof Record. Nothing hidden, everything verifiable.
- Delivery timestamp and certification status visible immediately upon arrival
- Protected files marked as certified with tamper-proof indicators
- One-tap access to the full Proof Record with cryptographic verification
Verifiable Proof, Not Just Trust
Certified Send replaces "trust me, I read it" with cryptographic evidence that is mathematically verifiable and tamper-proof.
Cryptographic Proof of Receipt
When the recipient opens your message, their device generates a signed receipt with timestamp, Hat code, and content hash. This proof is unforgeable and mathematically verifiable.
PROOFProtected Content Viewer
Certified messages open in a secure viewer that blocks screenshots, screen recording, copy-paste, and forwarding. The content stays between sender and recipient.
VIEWERSigned Read Receipts
Read receipts are cryptographically signed by the recipient's device keys. No one — not even City of Hats — can forge a receipt. Each one is uniquely tied to the message and moment.
SIGNEDTamper-Proof Chain
The entire certified send flow — composition, delivery, reading, and receipt — forms a tamper-proof chain. Any modification to any step is immediately detectable.
TAMPER-PROOFHow Certified Send Works
Four steps from composition to verifiable proof of reading.
Compose & Certify
Write your message and enable Certified Send. The app prepares the message with a content hash and certification metadata.
Encrypted Delivery
The message is end-to-end encrypted and delivered. The recipient sees a certified message notification with delivery confirmation.
Protected Viewing
The recipient opens the message in the Protected Viewer — a secure environment that prevents screenshots, recording, and copying.
Proof Generated
Upon viewing, the recipient's device signs a cryptographic receipt. The sender receives verifiable proof that the message was read, with timestamp.
When Proof Matters
Any situation where you need verifiable evidence that a message was delivered and read.
Legal Notices
Send legal communications with cryptographic proof of delivery and reading. Receipts are timestamped and verifiable — stronger than email read receipts.
Contract & Agreement Delivery
Deliver contracts and receive proof the other party opened and read them. The protected viewer prevents unauthorized copies.
Medical Communications
Send sensitive medical information with proof the patient received and viewed it. Protected viewer ensures no screenshots or leaks.
Financial Disclosures
Deliver financial statements, tax documents, or investment notices with verifiable proof of receipt. Audit-ready evidence.
Journalism & Sources
Send sensitive tips or documents with proof they reached the journalist. The protected viewer prevents unauthorized redistribution.
Corporate Compliance
Distribute compliance notices, policy updates, or HR communications with proof each employee received and read the message.
What We Enforce
Certified Send is built on cryptographic signatures, protected viewing, and zero-knowledge architecture.
✓ Enforced by Architecture
- ✓ Cryptographically signed proof of receipt
- ✓ Protected viewer blocks screenshots and recording
- ✓ End-to-end encrypted message content
- ✓ Timestamped delivery and read confirmations
- ✓ Tamper-proof certification chain
- ✓ Receipts verifiable by any party
✗ Never Allowed
- ✗ No forging or backdating receipts
- ✗ No screenshots or screen recording in viewer
- ✗ No copy-paste or forwarding from viewer
- ✗ No server-side access to message content
- ✗ No receipt generation without actual viewing