Don't take our word for it.
A registry is only as good as its guarantees. Every claim below is enforced by a mechanism, not a policy — and the ones that can be checked publicly, you can check right now, without an account.
Live ledger integrity check
Checking…
This is not a cached status badge. Each time this page loads, the registry re-derives the conservation invariant across every credit batch: current holdings plus retired quantity must exactly equal what was minted. The raw result is public at /public/registry/integrity.
Verify a retirement certificate
No login required. Verification works without any cooperation from the organisation that retired the credits.
The guarantees, and what enforces them
History cannot be rewritten — by anyone, including us
Every approval, trade, and retirement is recorded in an append-only audit trail enforced by a database-level trigger. UPDATE and DELETE are rejected by the database itself, not by application code that could be bypassed.
→ Enforced by a Postgres trigger on the audit_trail table.
Serial numbers are minted exactly once
A batch's serial number is generated inside the same database transaction that approves its issuance, from an atomic per-methodology counter. There is no code path that reconstructs or reissues a serial.
→ Row-locked sequence, single transaction — approval and serial are inseparable.
Payment and ownership move together, or not at all
Settlement is one atomic transaction: the holding transfers, the order completes, and the trade is captured together. There is no window where money moved but credits didn't, or the reverse.
→ Single database transaction; replayed payment confirmations are rejected.
Credits are whole tonnes, money is exact
Quantities are integers and money is fixed-precision decimal — floating-point drift cannot exist on this ledger. The books balance to the tonne and the paisa, always.
→ Integer tCO2e and Decimal money types at the database level.
Buffer pools are withheld before issuance
Each programme withholds a percentage of verified reductions into a buffer against future reversal, and the net quantity is always rounded down. A registry must never issue more than the evidence supports.
→ Buffer maths run inside the minting transaction; rounding is floor, never up.
Trading is KYC-gated
An organisation must pass KYC review before any of its orders can be accepted. Verification status is re-checked at acceptance time, not just when the order was placed.
→ Enforced server-side in the order-acceptance path.
The strongest guarantee is the one you verify yourself: browse the public registry and follow any serial number from issuance to retirement.