For cryptographers & security researchers

Break it before it matters.

Versidian is building privacy-preserving age verification: verify once, then prove you're old enough anywhere, via zero-knowledge proofs from your own device. A platform learns a yes/no and a per-platform audit signal — nothing else.

In this field, assertions earn nothing. Systems earn trust by surviving attack — and the cheapest time to attack one is before anyone depends on it. That's now. Pre-launch, your break costs us a redesign. Post-launch, it costs people their privacy.

The claims we're staking

These are public commitments. We want them attacked.

Unlinkability. Two platforms should not be able to tell they've met the same person — including if they collude.

Verify once, keep nothing. Documents checked once, the underlying personal data then destroyed — that's the design. What survives should let a person prove a fact, never reconstruct an identity.

No user database — while still limiting abuse. Anyone who's read Chaum knows exactly which question that raises. So do we. It's a good one to press on.

Architecture over promises. Protections should hold because of how the system is built, not because a policy says so.

What we deliberately won't say here

The construction. Pre-review and mid-filing, that silence is policy, not coyness. Detail flows in stages — architecture and threat model under NDA, the full review packet under an engagement — and if NDAs conflict with your publication commitments, say so in the first email; we'd rather negotiate that early than discover it late.

Judge us here on whether the claims are well-posed and the process is sound.

The standing rule

No cryptographic construction ships to production without independent expert review, and designs are red-teamed against named adversary classes before they're built. This page exists to make that rule enforceable by strangers.

Ways in — smallest first

Point us at prior art. If this exists, or was broken in 1997, we want the citation. Two-minute email; genuinely valuable. Already on our map: Chaumian credentials, Idemix and U-Prove, W3C Verifiable Credentials, mDL selective disclosure, zk-creds (Rosenberg et al., IEEE S&P 2023), and Google's ZKP age work — cite past these.
Poke a hole in the threat model. A paragraph of skepticism is a contribution.
Formal review. Paid, once funded — we're pre-funding and would rather say so plainly.
Advisory. For the right person, as the company formalizes.

Every finding that changes the design gets credited — in the eventual public security documentation, and in anything we publish — or kept anonymous, your call.

Where things stand

Versidian Inc, a Delaware public benefit corporation. Provisional patent applications filed. Proof of concept in active development. No production system, no users, no user data.

tech@versidian.com — PGP key and security contact at /.well-known/security.txt

Key fingerprint: 7FDD D77A 4A2F 8E88 991E 9B09 9C59 EFE2 A22A 17B2

Page maintained · last reviewed 24 August 2026.