Every snapshot, hashed. Re-hash it yourself.

Every dated snapshot Fonteum publishes is SHA-256 hashed and attested at write time. Re-fetch the upstream source archive, run shasum -a 256, and compare to the hash on file at /verify/[snapshot_id]. A 64-character match means the bytes you read are byte-exact to what we ingested.

0 attestations on file across 0 source families. Foundation layer for the §sprint3-attestation-chain Certificate-Transparency-style chain — hashes ship first, chain semantics layer on top once 30+ snapshots have accumulated.

How to re-hash a snapshot →

Security & compliance

What we run on, and what we hold.

SOC 2: Type 1 audit in progress, target September 2026.
Infrastructure: Hosted on Vercel (edge network). Data warehouse: Supabase (PostgreSQL). All data at rest encrypted. All data in transit TLS 1.2+.
Data scope: Public-domain federal regulatory records only. No PHI. No PII beyond what appears in federal public records. No BAA required.
Snapshot integrity: Every ingestion run produces a SHA-256 hash stored in snapshot_attestations. Verify any snapshot at /verify/[id].
Security contact

Recent attestations

0 hashes, grouped by source.

No attestations are on file yet. The migration ships in this wave; the backfill runs post-merge per docs/runbooks/backfill-attestations.md. Check back after the operator-side script finishes.

Public deposits

Methodology paper, Zenodo DOI, public DuckDB drop, Hugging Face mirror — every Fonteum dataset is reproducible. The hashes above are how a verifier proves it.

Zenodo

DOI 10.5281/zenodo.14872055
deposited 2026-05-08

medRxiv

preprint 2026.05.08.26337284
methodology paper · v1.0

Hugging Face

dataset · 2.1 GB
6.8M+ records · NDJSON

DuckDB

public drop · parquet
read-only · v2026.05.0

GitHub

provider-graph-spec
v1.0 · MIT licensed

security@fonteum.com

Compliance posture

Compliance posture

Every snapshot, hashed. Re-hash it yourself.

What we run on, and what we hold.

0 hashes, grouped by source.