When you delete a workspace, we email you a signed certificate. This page publishes the public key you can use to verify it - so you don't have to take our word for it.
The signing key
Algorithm: Ed25519. The public key is served as a static file at the well-known location below.
https://pocodot.ai/.well-known/deletion-signing-key.pubThe actual key material will be published once cryptographic deletion ships (rolling out in the coming weeks). Until then, this page reserves the URL and documents the verification flow.
Two ways to verify
Easiest: in-browser verifier
Paste the certificate from your deletion email into our verifier. It runs entirely in your browser using libsodium-js - your certificate never leaves your device.
Open the in-browser verifier →
Offline: command line
For security teams that prefer offline verification:
# Download our public key
curl -sS https://pocodot.ai/.well-known/deletion-signing-key.pub -o pocodot.pub
# Save the certificate's payload and signature from your email
printf '%s' '<payload>' > /tmp/payload.bin
printf '%s' '<signature>' | base64 --decode > /tmp/sig.bin
# Verify
openssl pkeyutl -verify -pubin -inkey pocodot.pub \
-rawin -in /tmp/payload.bin -sigfile /tmp/sig.binWindows users: run the openssl command under WSL or Git-Bash, or use the in-browser verifier above.
Reporting a security problem
Email security@pocodot.ai. Include what you found and how to reproduce it. We credit responsible reporters in our release notes (with their permission). Our PGP key is published below once finalised.