How we verify

What the verification page tells you

Every credential has a permanent page at /verify/<credential ID>. It shows six things and no more: the holder’s name, the certificate and its version, when it was issued, when it expires, whether it is currently valid, and — if it is not — a neutral category explaining why.

It deliberately does not show the holder’s email address, their score, or how many attempts they took. Those are the holder’s business, and a verifier does not need them to answer the only question they have.

How the signature works

When a certificate is issued we build a canonical record of the claim — who it is for, which exam and version, when it was issued and when it expires — and sign it with an Ed25519 key held only on our server. The signature and a hash of that record are stored with the certificate.

The public half of every key we have ever used is published at /.well-known/bizomatic-keys.json. That means a third party can check a signature themselves, with no access to our systems and no cooperation from us — which is the entire point. Retired keys stay published forever, because every certificate they signed must keep verifying.

Revocation is immediate

If a certificate is withdrawn — because it was issued in error, or because the attempt behind it was voided for integrity — the verification page says so on the very next request. It is never cached. A withdrawn certificate is never deleted: its page keeps resolving and keeps telling the truth, because a link an employer saved should not quietly become a dead end.

What makes the exam worth certifying

• Every candidate draws a different set of questions from the same blueprint, so two people sitting the same exam do not see the same paper.
• The clock runs on our server. Closing the browser does not stop it, and does not lose the answers already given.
• Correct answers are never sent to the candidate’s browser during an attempt. Scoring happens on the server, from the server’s own record of the form.
• Every change to an exam, a question, a score or a certificate is written to an append-only audit log.

If something looks wrong

If a certificate does not resolve, check the ID for transcription slips — the alphabet excludes I, L, O and U precisely because they are mistaken for 1, 0 and V, and we fold those automatically. If it still does not resolve, or if you believe a certificate is being misrepresented, write to support@bizomatic.in with the credential ID.