Every serious procurement process asks the continuity question: what happens to us if this vendor folds, gets acquired, or sunsets the product? For most software the answer is an export and a migration project. For an integrity vendor the question is sharper, because the entire value proposition is durable, long-lived evidence — and evidence that depends on the continued existence of one company is not durable at all. The only satisfying answer is structural.
Why this question is harder for an integrity vendor
If your CRM vendor disappears, you lose a tool and migrate your data. Painful, survivable. If your integrity vendor disappears and your proofs only verify inside their system, you do not just lose a tool — you lose the ability to demonstrate that records you anchored years ago are still intact. The evidence becomes unverifiable at exactly the moment, years later, when you need it for an audit or a dispute.
This is the same concentration-risk lesson the industry learned when a major cloud ledger service was shut down: any evidence layer whose verification depends on a single provider inherits that provider's mortality. The fix is not to pick a bigger vendor. It is to make verification independent of the vendor entirely.
What 'independent of the vendor' requires
Three properties have to hold for your evidence to survive the vendor that created it:
- Public anchoring — the integrity root is written to a public blockchain, not a private ledger the vendor controls. The reference point exists independently of the company and remains readable whether or not the company does.
- A self-contained proof package — for each record you hold the hash, the Merkle path, and the on-chain reference. That package is enough to verify the record against the public anchor using nothing but the record and publicly available data.
- An open, documented verification method — the algorithm to check a proof is standard and published, so any competent engineer, or an independent open-source tool, can confirm pass or fail without the vendor's cooperation or software.
The honest current state
It is worth being precise about what exists today versus what is on the roadmap, because vendor continuity is exactly the topic where overclaiming destroys trust. The architectural properties above are real: anchoring is to a public chain, and proof packages are self-contained and built on standard Merkle verification.
A fully open-source verification CLI — a single tool you run yourself that takes a proof package and returns pass or fail with no Certyo involvement — is a committed deliverable on the roadmap, not something we will claim is already published. The durability guarantee we are comfortable making today rests on the architecture, on contractual source-availability and escrow terms, and on the fact that the public anchor and the standard proof format do not require us to remain in business.
What independent verification looks like
The end state is a verification flow that touches none of the vendor's infrastructure:
Notice that the vendor's servers appear nowhere in that flow. You hold the proof package, the public chain holds the anchor, and the comparison is arithmetic anyone can perform. That is what turns the scariest due-diligence question — 'what if you fold?' — into a non-issue: the proof was never relying on us being alive to begin with.
How to pressure-test any integrity vendor
Bring these three questions to any vendor whose product is evidence, including us:
- Where is the anchor? — If the integrity reference lives in a private ledger the vendor controls, your continuity risk equals their corporate risk. Insist on a public chain.
- Can I verify without you? — Ask them to walk through verifying a proof using only the proof package and public data. If the answer requires their API, the evidence is not vendor-independent.
- What's in writing? — Source-availability, escrow, and a documented proof format turn a verbal 'we'll be around' into terms that survive the vendor.
Turning the biggest risk into the moat
The continuity question is usually framed as a weakness for a young vendor to defend against. It is actually the strongest place to compete. A platform that can honestly say 'your evidence does not depend on our survival, here is exactly how to verify it without us, and here is what we have committed to in writing' has converted its biggest perceived risk into a structural advantage that the incumbents — whose verification lives inside their own cloud — cannot match. Ask the question of every vendor. The good ones will welcome it.
The right answer to 'what if you disappear?' is not 'we won't.' It is 'your proof was never relying on us being alive — here is how to verify it without us.'