Portable patient summaries,
provable without exposing the record.
Build an IPS bundle, issue a verifiable credential over its digest, and anchor a privacy-preserving commitment on the Midnight Undeployed network — the clinical record never leaves your own database.
- Sections
- IPS-profiled
- Claims
- Digest only
- Anchor
- ZK commitment
- Bundle validated12 resources · 6 sections01
- Digest computedsha256:9f4c…a2e202
- Credential issueddid:prism:8b1c…03
- Commitment anchoredblock #39704
- Ledger membershipcommitments.member → true05
What the console does
Four surfaces, one chain of custody.
Compose & validate
A guided FHIR builder plus raw upload, checked against the IPS section profile before anything leaves the page.
Credential with Identus
Issue a verifiable credential that carries the summary digest and an over-18 flag — never the clinical content.
Anchor on Midnight
A salted commitment goes on the Undeployed ledger through a Compact circuit and a Fly-hosted proof server.
Verify honestly
Recompute the digest, recompute the commitment from its salt, and prove ledger membership. Unperformed checks say so.
Digest → credential → anchor
Each hop carries strictly less information than the last. By the time anything reaches a public ledger, all that remains is a salted commitment.
- 01
Digest
The IPS bundle is canonicalised and hashed. The bundle itself never leaves your database.
- 02
Credential
Identus issues a verifiable credential over the digest — minimal claims by design.
- 03
Anchor
A salted commitment is proved and inserted into the IpsAnchorRegistry set on Midnight.
Trust model
Honest about what is proved.
This console does not verify issuer signatures, resolve DIDs externally, or check revocation status — and it says so in the interface rather than showing a green tick.
- Clinical content stays server-side, behind row-level security
- Credentials carry a digest and an over-18 flag — no name, no date of birth
- Anchors are confirmed by ledger membership, never by a bare transaction hash
- Checks the console cannot perform are reported as “not checked”, never as green