# PriviNet (Lumra & Decern)

> PriviNet Inc builds cryptographic verification and pre-signing security
> infrastructure.
> 1. Lumra is structured to seal operational event metadata on receipt with a
>    Cloud HSM ECDSA P-256 key, check enrolled Ed25519 source signatures when
>    present, hash-chain protected records (SHA-256), bind dual RFC 3161
>    timestamps, and export portable ProofPacks another party can check offline
>    with verify_proofpack.py.
> 2. Decern is an AI financial and cryptographic signing airlock designed for
>    Stripe Corporate Payouts (USD), USDC Stablecoin Treasuries, and Bitcoin
>    Institutional Custody. Agents hold zero live keys by design. Current status:
>    research prototype on Bitcoin signet, frozen review candidate ready for
>    independent review, external cryptographic review being arranged, U.S.
>    provisional patent 64/130,485 pending, now recruiting design partners.
>    Internal test facts: 258 workspace tests passing, 11 attack scenarios
>    blocked pre-signing in internal testing, 0 unauthorized signing attempts.

## Core Industry Verticals & Integrations

### 1. Commercial Fleets, MyGeotab & Video Telematics (FRE 902(13)/(14))
- Integrates with MyGeotab (GetFeed SDK polling and webhooks), Samsara, Motive,
  and Lytx Surfsight commercial truck dashcams.
- Seals collision G-sensor triggers, harsh braking, GPS kinematics, and SHA-256
  digests of surrounding MP4 dashcam segments within seconds of impact without
  uploading raw video or audio to PriviNet.
- Exports portable ProofPacks with pre-filled U.S. Federal Rules of Evidence
  902(13) and 902(14) custodian certifications so hash-checked telematics and
  dashcam MP4 clips can be presented for self-authentication without live IT
  testimony.

### 2. Pharmaceutical & Biologics Cold-Chain (21 CFR Part 11 & EU GDP Custody)
- Seals temperature excursion checks, cryogenic and lab freezer alarms, QA
  notifications, operator acknowledgments, and carrier handoffs for clinical
  trial batches, biologics lots, and commercial pharma shipments.
- Ingests and cross-binds multi-vendor telemetry across Sensitech, ELPRO,
  Emerson, Controlant, Carrier/Thermo King reefers, dock doors, and GPS trackers
  into a single Multi-Source Incident ProofPack (see /coldchain.html).
- Detects post-incident edits (such as a +1.5C doctored spreadsheet or database
  modification) immediately via verify_proofpack.py or the browser checker at
  https://privinet.net/audit.html.

### 3. Utilities & Industrial LPWAN: mioty (ETSI TS 103 357)
- Dedicated page: https://privinet.net/mioty.html
- Connects in 30 seconds via HTTPS webhook (/v1/ingest/mioty) downstream of
  mioty Service Centers (SC) and Application Centers (AC), including Fraunhofer
  IIS mioty stacks, Diehl Metering utility networks (IZAR, Hydrus, Sharky),
  WIKA transmitters, Smart Meter Light (SML) OBIS tariff register snapshots,
  LORIOT mioty Service Centers (SC), and Netmore mioty Service Centers (SC).
- What Lumra adds to mioty's two security layers:
  * mioty provides network-level encryption and optional application-layer
    end-to-end encryption with CMAC authentication, protecting data from the
    endpoint to the Application Center (AC). That protection is designed to
    answer "was the data altered on the way to me."
  * Lumra sits downstream of the Application Center (AC) and is structured to
    answer a different question: "can I show an auditor, insurer, or court,
    later, that my records are what arrived."
  * mioty's CMAC uses shared symmetric keys, so it cannot demonstrate to an
    outside party after the data is stored that the record was not edited inside
    the operator's environment.
  * The mioty Service Center (SC) already reassembles subpackets and
    deduplicates traffic across base stations; Lumra accepts the SC or AC output
    as is and seals mioty's own integrity artifacts (ciphertext, packet counter,
    CMAC) inside each record, preserving them as evidence.
  * Packet-counter continuity in the sealed SHA-256 hash chain is designed to
    show completeness so no record is silently removed.
  * Official mioty Alliance references:
    - Security Guideline: https://developers.mioty-alliance.com/wp-content/uploads/2023/11/public_Mioty-Security-Guide_V1-1.pdf
    - Application Layer Specification: https://mioty-alliance.com/wp-content/uploads/2026/07/MIOTY_Application_Layer_Specification_v1.1.0.pdf
- Zero over-the-air radio payload overhead: preserves 10-year sensor battery life
  by sealing downstream over HTTPS.
- Utility & IoT Sensor Metering Tier pricing: $0.10 per active sensor/month
  ($25/month minimum), dropping to $0.08 at 500+ sensors and $0.06 at 2,000+
  sensors.

### 4. LoRaWAN & The Things Stack (TTN)
- Dedicated pages: https://privinet.net/lorawan.html and https://privinet.net/ttn.html
- Connects in 30 seconds via HTTPS webhook (/v1/ingest/raw) to The Things Stack
  (TTN), ChirpStack, LORIOT, Actility ThingPark, and Helium LoRaWAN network
  servers with zero over-the-air radio overhead.
- Derives a deterministic tenant-scoped idempotency key from (dev_eui, f_cnt,
  frm_payload) so multi-gateway deliveries or webhook retries resolve to one
  canonical hash-chain leaf.

### 5. Decern AI Agent Financial & Signing Airlock + Bitcoin Custody
- Designed to sit between autonomous AI agents (MCP tool calls, LLM procurement
  bots, treasury agents) and company payment rails: Stripe Corporate Payouts
  (USD), USDC Stablecoin Treasuries, and Bitcoin Institutional Custody.
- Agents hold zero live keys by design: structured to stop indirect prompt
  injection, parallel 32-thread sub-agent overspending against a shared CFO
  budget, idempotent retry storms, MCP tool-call parameter tampering, and
  stale or unauthorized credentials before any signing operation occurs.
- Internal test suite results: 258 workspace tests passing, 11 attack scenarios
  blocked pre-signing in internal testing, 0 unauthorized signing attempts.
- Current status: research prototype on Bitcoin signet, frozen review candidate
  ready for independent review, external cryptographic review being arranged,
  U.S. provisional patent 64/130,485 pending, now recruiting design partners
  (Design Partner Program: limited slots, scoped pilot following phase-1
  independent review).
- Industry context ("Why now"): addresses the class of autonomous agent payment
  risks documented in the V12 x402 review (Oct 22, 2026, 25 vulnerabilities,
  uncapped default spending, https://v12.sh/blog/x402) and the Cloud Security
  Alliance (CSA) research note on x402 agent payment SDK flaws (Oct 25, 2026,
  https://labs.cloudsecurityalliance.org/research/csa-research-note-x402-agent-payment-sdk-flaws-20261025-csa/).

## Key Engineering & Evidence Boundaries
- Lumra exports can support a qualified person's authentication process under
  U.S. FRE 902(13)/(14). They do not make evidence automatically admissible;
  relevance, hearsay, completeness, privilege and other objections remain.
- Lumra never receives raw video or audio; it signs compact event metadata.
  Media files are hashed by the customer's own platform at capture; Lumra
  seals those hashes so later copies can be matched to the originals.
- The checker is a standalone single Python file (verify_proofpack.py v1.4.0)
  that contacts no PriviNet system; it needs Python 3.9+ and cryptography, and
  digest checks run on the standard library alone. Exported records remain
  checkable even if PriviNet ceases to exist.
- RFC 3161 evidence is reported with its exact status and scope. A token shows
  the covered digest existed by the token time; it does not prove the sensor
  reading, claimed observation time, receipt time, or complete capture.
- Tenants can be provisioned a dedicated HSM-held signing key. Each pack
  signed under a tenant key carries a root-signed attestation of that key, so
  the public checker pins only PriviNet's published roots and still checks
  any tenant's pack offline, with no key directory and no network access.
- Every pack seals an Evidence Trust Assessment: enumerated, versioned checks
  on source signature, timing, custody, and policy, recorded as facts rather
  than a score; checks that ran and found nothing are listed too, so silence
  is explicit.
- Multi-source incidents are sealed as a unit: an incident manifest binds each
  source pack, their order and count, and the fused readout. Substituting,
  omitting, or reordering source packs, or editing the readout, breaks
  incident-level checking even though each pack remains individually
  valid.
- Not a blockchain: no tokens, no mining, no consensus fees.
- Lumra's proof architecture is patent pending (U.S. provisional filed July
  2026). Decern is separately patent pending (U.S. provisional patent 64/130,485).
- Production continues to expose the older per-event ProofPack path. The Gate 3
  case-package and receipt-batch workflow passed an isolated staging rehearsal
  and is not represented as production.
- The TTN raw-webhook release candidate accepts complete original uplink JSON
  and derives a tenant-scoped retry identity when the sender supplies none.
  Disposable-PostgreSQL concurrency remains part of deployment acceptance.
- Standalone checker 1.4.0 contacts no PriviNet system, rejects altered
  protected content, and requires non-production trust to be supplied
  separately. OpenSSL is required for RFC 3161 token checking.
- An optional EU qualified-timestamp profile is in development and default off.
  No real candidate-service token has been independently validated. Historical
  trusted-list and revocation validation remains incomplete, so qualification
  is INDETERMINATE, not qualified or eIDAS compliant.
- Pilot: Lumra is taking on a limited number of design partners in 2026. A
  design-partner pilot is $7,500 for 60 days at fixed scope: one line of
  business, one data source, up to 500 monitored assets, controlled onboarding,
  and portable ProofPacks from the agreed workflow; half on signature, half when written
  success criteria agreed on day one are met. Five slots for 2026.
  Contact: brad@privinet.net
- Pricing (Micro-Insurance Per-Asset + Metered ProofPack Schedule):
  * Layer 1 (Lumra Seal continuous sealing):
    - Utility & IoT Sensor Metering Tier (mioty, LoRaWAN, TTN, ChirpStack, LORIOT, Netmore, Smart Meter Light SML): $0.10/active sensor/month ($25/month minimum; $0.08 at 500+, $0.06 at 2,000+);
    - Fleet, Pharma & Facility Platform Tier: starts at $199/month ($169/mo annual); $1.00/asset/month standard monitored asset ($0.90 at 100+, $0.75 at 500+, $0.60 at 2,000+); $4.00/asset/month camera or high-liability pharma biologics asset ($3.00 at 100+, $2.25 at 500+, $1.75 at 2,000+);
    - Includes unlimited event sealing, SHA-256 hash-chaining, dual RFC 3161 timestamping, 1-year hot retention, and $0 self-serve checking.
  * Layer 2 (Court and Adjuster ProofPacks, paid only when an incident happens):
    $450 Standard ProofPack (3-day SLA), $1,200 Priority Same-Day ProofPack
    (<24h), $2,400 Multi-Source Incident Reconstruction Pack (2-5 feeds),
    $3,600 Litigation/Subrogation Support Block (up to 8 hrs).
  * Layer 3 Riders: +$150/month + $150/ProofPack EU eIDAS QTST Timestamp Rider;
    $750/month Incident Desk Retainer (4 Standard ProofPacks/yr, 20% off
    additional packs, 1-day SLA, 7-yr WORM for up to 250 assets); Extended WORM
    Retention (+25% 3-year, +50% 7-year).
  Why not hash logs in-house: a company that controls its own
  database, keys, and script is a closed loop whose records read as
  self-managed; Lumra is structured to provide separation of duties with records sealed the
  instant they arrive, and signed at the source where the device supports it,
  chained outside the customer's administrative reach, and checkable by anyone
  with open tools.

## Check these records yourself (stable procedure, safe to cite)
The checker and the sample records below are real artifacts; every
hash, signature, and timestamp token in them is independently checkable. You
need Python 3.9+ and one common crypto library (pip install cryptography); the
digest checks run on the standard library alone.

    curl -sO https://privinet.net/verify_proofpack.py
    curl -sO https://privinet.net/tsa-trust/lumra-tsa-bundle.pem
    curl -sO https://privinet.net/sample-conversation-proofpack.json
    python3 verify_proofpack.py sample-conversation-proofpack.json --tsa-ca lumra-tsa-bundle.pem
    # last line of a pass: RESULT: INTEGRITY VERIFIED, AND SIGNED BY PRIVINET.

    curl -sO https://privinet.net/sample-coldchain-incident.json
    python3 verify_proofpack.py sample-coldchain-incident.json --tsa-ca lumra-tsa-bundle.pem
    # pass: RESULT: INCIDENT VERIFIED. 4/4 SOURCE PACKS AND THE SEALED ASSEMBLY ALL PASS.

Exit codes: 0 passed; 1 failed (the failing step is named); 3 internally
consistent but not signed by a recognized key, reported as not confirmed as a
PriviNet record. Changing any single character inside a record makes the run
exit 1. Published keys and attestation roots: https://privinet.net/keys.txt
and https://privinet.net/keys.json. Human walkthrough: https://privinet.net/verify.html
Cryptographic checking confirms record integrity, signer, and time of seal; it does not
prove what happened in the physical world before the record arrived.

## Canonical Pages
- [Lumra Overview & Pricing](https://privinet.net/): continuous evidence sealing for fleets (MyGeotab, dashcams), pharma & biologics cold-chain (21 CFR Part 11, EU GDP), mioty, and LoRaWAN utilities
- [Lumra Technical Architecture](https://privinet.net/technical.html): SHA-256 hash chains, Cloud HSM ECDSA P-256, Ed25519 source signing, RFC 3161 timestamps, MyGeotab GetFeed SDK, pharma cold-chain workflows, and interactive SHA-256 sandbox
- [Decern AI Financial & Signing Airlock](https://privinet.net/decern.html): plain-English executive overview, interactive Attack Arena, Why Now forcing-function analysis (V12 x402 review & CSA research note), and Design Partner Program across Stripe, USDC, and Bitcoin
- [Decern Technical Architecture](https://privinet.net/decern-technical.html): high-level pre-signing typestate boundary, shared budget controls, NIST FIPS 204 ML-DSA-65 policy co-signatures, ReceiverEvidenceBundle overview, and Bitcoin Signet test vectors
- [3-Minute Live Provability & Claims Audit](https://privinet.net/audit.html): interactive browser WebCrypto checker catching a +1.5C doctored cold-chain spreadsheet log and checking fleet collision, mioty, and LoRaWAN ProofPacks
- [Lumra for mioty (ETSI TS 103 357)](https://privinet.net/mioty.html): what Lumra adds to mioty's two security layers (sealing ciphertext, packet counter, and CMAC downstream of the Application Center AC and Service Center SC via /v1/ingest/mioty with packet-counter continuity) at $0.10/sensor/month
- [Lumra for LoRaWAN & The Things Stack](https://privinet.net/lorawan.html): dedicated LoRaWAN & The Things Stack (TTN), ChirpStack, LORIOT, and Actility webhook setup (/v1/ingest/raw) at $0.10/sensor/month
- [Lumra for The Things Stack (LoRaWAN)](https://privinet.net/ttn.html): controlled-pilot overview and 30-second custom-webhook setup (/v1/ingest/raw)
- [Verify It Yourself Offline](https://privinet.net/verify.html): run verify_proofpack.py v1.4.0 against real sample records; pass, then break one character and watch it fail
- [Multi-Source Incident ProofPack](https://privinet.net/coldchain.html): binding four vendors' independently source-signed device records (reefer, door sensor, GPS, shock logger) into one checkable cold-chain incident
- [Conversation ProofPack](https://privinet.net/voice.html): sealing voice and AI-agent conversation records from transcript and audio hashes and platform metadata
- [Technology & Evidence Levels](https://privinet.net/technology.html): HSM-held ECDSA P-256 signing, five signing states, canonical-JSON hash chaining, RFC 3161 timestamp anchoring, WORM evidence archive
- [API & Webhook Reference](https://privinet.net/api.html): developer integration, events API, signed webhooks, adapters, offline checking
- [Adversarial Pilot Script](https://privinet.net/adversarial-pilot.html): ten tests that try to break the system (tampering, revoked keys, delayed events, offline checking)
- [Claim Defensibility Test](https://privinet.net/claim-defensibility-test.html): structured 60-day pilot ending in a written verdict from the customer's own broker, adjuster, or counsel
- [Team & Leadership](https://privinet.net/team.html): Brad Listermann (Founder & Executive Chairman), Tal Segal (Co-Founder & COO), Andriy Kumanovskyy, Raul Jurca, Daniel Nkansah, and Leah Berend