A New Standard for Trust and Credibility

The organizer, the allocator, the sponsor

Three Sides Of One Failure

Credibility does not fail in one place. It fails three separate people on the same evening, in three separate ways, and each of them walks out blaming something else entirely, so the cause survives every post mortem and turns up again at the next one.

The organizer

You have exactly one filter available to you today, and it is a gate fee set high enough to hurt. It selects for willingness to pay rather than for capital, and it turns away precisely the people whose presence makes the evening worth attending, because allocators of that caliber are usually attending free. So the fee excludes your best guests and admits anyone prepared to write a check and say the right thing on the way in.

An attendee who talked their way in costs you twice: once in the seat, and once in the standing of every program you run afterwards. Assertion is not a standard.

The allocator

They come for peers, and peers are the first thing solicitation drives out. They want to speak freely with the person beside them on the understanding that they are not about to be pitched, and an evening that cannot tell the two apart cannot promise them that. So they reprove the same fact at every door, hand their position to strangers to do it, and find that the proof they gave you last month does nothing for them anywhere this month.

And when the claims they hear stop being credible they do not complain to you. They simply do not come back, which is the failure nobody sees until it has already happened.

The sponsor

They are buying access to capital that can actually deploy, and proof is the only thing that makes that credible. An evening with an enforced standard, built on evidence each attendee presented, is a materially better use of a marketing budget than one whose audience is described to them rather than demonstrated. And they are living the allocator’s exhaustion from the other side, filtering through a sea of people selling them something to find the one who is not.

Both halves of the guest list

What You Are Screening

Two populations walk into any event worth convening, and a standard that only handles one of them leaves the door open at the other end. There are the people asking to be admitted, and there are the groups asking to present. Each gets its own screen, and neither screen is your opinion.

The individual asking in

A person is verified once, at a level they choose from the published ladder, by a licensed professional they already engage rather than by us. What that establishes is exact and is worth stating exactly: that a named professional, whose license was checked against the regulator’s own published register, attested to that person’s standing at that rung, on a date, in a document whose evidence never left them.

Your door then learns one thing about that person, and it is the only thing you need. The bar was cleared.

The group raising capital

A sponsor asking to present at your summit passes seven named checks before it is admitted: identity, that the entity exists in good legal order, any regulatory license its trade requires, adverse media, disqualifiers, sanctions and watchlist screening, and litigation posture. Five findings no approval authority may override. A named human takes the decision, and the database refuses an admission the screen would have let through.

Why the seven exist

At a past event a sponsor had already signed on before it emerged that its founder had been in trouble with the Federal Trade Commission in the 1990s. It was found afterwards, not before. That is why seven checks now stand between a sponsor and a room.

Found afterwards is the whole problem, and it is the same problem at both ends of the guest list. A standard is what moves the finding to before.

Asset protection, privacy, and what a leak would find

What Is Never Held

The people you most want in attendance are the people with the most to lose by being cataloged, and they know it better than anybody advising them. Every disclosure they have ever made about their position still sits on somebody’s server, under a retention policy they never read, protected by a promise they cannot audit and a company they did not choose. Ask them to prove themselves the old way and a proportion of them will simply decline the evening.

The question is never whether a platform intends to keep their figures safe. The question is whether it holds them at all.

This one does not.

The guarantees, in full

No figure. No amount, no statement, no holding and no structure is stored. The credential carries a rung, and a rung is a position on a public ladder rather than a number about a person.

No level disclosed at the door. A room learns that its bar was cleared. It does not learn by how much.

No member of one licensee is visible to another. A licensee’s people live in that licensee’s own store, and no code path reads across them.

The licensor holds no register of members at all. It holds licenses, an issuer register and a root key, and no name. The papers written about a member are kept in its vault, sealed under the key of the deployment that verified them, a key InvestorPass does not hold.

An attesting professional’s own file cannot name a client. There is no column to follow.

Every opening of a person’s file is logged, and the person can read the log. Any holder may see, at any time, what is held about them, who opened it, and what was disclosed.

These are not policies. A policy is a sentence somebody can revise on a Tuesday. Each of the six above is enforced in the shape of the database itself, which is why a deployment runs two separate stores rather than one: the people who apply and hold credentials sit in the first, the business the deployment runs sits in the second, and one test decides which side any record falls on.

The test that decides it

A leak of the operating store must disclose nothing about a member.

So a seat at a gathering names a person, and the seat sits with the people. The gathering does not. The two stores are two databases with no join between them, and the rule refusing a query that reaches across is enforced in code rather than remembered by whoever writes the next one.

Verified once, at a level they choose

One Ladder, Eight Rungs

Every standard worth clearing is public, fixed, and identical for everybody, because a bar that moves is a bar somebody is negotiating. There are eight rungs, they are published, and a forum whose bar is not on the ladder is one no credential can be checked against.

5M · 10M · 20M · 50M · 100M · 250M · 500M · 1B+

1. I

   They choose the rung. The applicant selects the level they wish to be verified for, and that choice is printed into what their professional is asked to sign. Nobody assigns it to them.

2. II

   Their own professional confirms it. A licensed professional they already engage, their accountant, their attorney, their banker or their adviser, attests to the standing. Where a license must be checked it is checked against the regulator's own published register and never against a search engine.

3. III

   A named human cuts the credential. The issuing deployment signs it with its own enrolled key, and the licensor counter-signs before it verifies anywhere. A certificate carrying only its issuer's signature is provisional and fails verification in those words.

4. IV

   Your door reads it. Presented from their own device, checked at your entrance, answered in seconds.

Whose judgment it is

The verification is never the platform’s own judgment. InvestorPass reaches no verdict about anybody’s money. It records that a named, licensed professional reached one, and it records where that professional’s license was checked.

What the credential carries

The subject is an opaque reference. The format refuses anything shaped like prose, a name or an address. Every claim carries a hash pointing at its evidence, held sealed under the issuer’s key, and the evidence itself never travels.

How long the credential lasts

Once a person is verified, they will stay verified. The credential will not expire and will never need renewing; it will end only if it is revoked.

On the night, at your entrance

The Door

An entrance is where a promise about an audience either holds or quietly stops being true, and it holds for about four seconds a guest before the queue behind them becomes the evening’s first impression. So the check has to be quick, it has to be certain, and it cannot depend on anybody’s server answering in time.

How a check works

A door checks all of it in the organizer’s own browser, and reaches the licensor for nothing at the moment of checking. Suspending or revoking an issuer will stop it issuing and will leave every credential it issued standing; what refuses one person’s credential is its own identifier on the revocation list, which reaches every checker that has refreshed its copy, without touching one row of anybody’s data.

Verification runs in a fixed order: the register’s own chain, the issuer’s signature against the key the register holds, the scope of what that issuer is licensed to claim, and the licensor’s counter-signature, with the date checked only on a certificate issued before the credential became lifelong. Any failure fails the whole, and there is no override on the night. An issuer suspended or revoked stops issuing, and every credential it issued before then still stands.

Your door learns that the bar was cleared. It does not learn by how much, it does not learn what was proved to whom, and it holds nothing about your guest afterwards.

Your audience, proved rather than described.

What a stranger can check without asking anybody

Two Signatures

Trust that rests on one party’s word is not trust, it is exposure with better manners, and a standard asking you to take ours on faith would be the same failure one level up. So nothing here rests on our word. A root key signs the register’s chain and nothing else, and it stays offline. A licensee’s own key signs the credentials that licensee issues, on that licensee’s own infrastructure. The licensor counter-signs each one before it verifies anywhere.

Two signatures rather than one, because a licensee issuing alone means the standard is enforced at enrollment and never again at the moment that matters.

What the counter-signature costs in privacy

There is no personal data in a certificate to learn. The licensor signs a document, not a person.

The register is appended to and never edited. Every suspension, reinstatement and revocation is a dated entry carrying its reason, and that record is permanent and public. Anybody can verify the chain themselves, including your guests, including you.

Your installation, your accounts, your operator

What You Keep

Any platform holding your members holds you, and every organizer who has tried to leave one knows exactly what that costs and precisely when they found out. So this is drawn the other way. You get your own installation of the software, on your own web address, in accounts opened in your name, run by a person you appoint. We set it up for you and then we hand it over.

The clause that matters

The licensee’s data is the licensee’s. It belongs to the licensee, and it leaves with the licensee. Termination revokes the enrollment, and from that moment every certificate that deployment issued fails verification at the standing check, and that is the whole of the remedy at the register. It does not touch the licensee’s database or its member data, and non-payment gives the licensor no right over that data at all.

We can end your ability to issue, and we can do nothing else to you. Not alter it, not withhold it, and not read it, save for an audit under your license, made in your own systems and keeping nothing. That is the entire lever, it is deliberate, and it is the reason the arrangement is worth signing.

Your allocators are never charged for the credential.

Where this goes

One Standard, Many Doors

A credential is only worth carrying if the next door honors it too, which is why this was built as a standard with a public register rather than as a product with a customer list. Every licensed deployment issues under the same eight rungs, against the same register, and a pass earned at one forum is checked at the next without either of them speaking to us or to each other.

One verification, done properly, by a professional who already knows the person. One ladder, public and fixed. One register a stranger can check. And an organizer, anywhere, who can finally prove what they have only ever been able to assert.

Credibility, made portable.

The boundary, and it is the point

What Is Not Claimed

• The platform reaches no verdict about anybody's money. It records that a named, licensed professional reached one.
• It is not a regulated service. It is not investment advice, not an offer, not a solicitation, and not a recommendation of any offering, sponsor, manager or transaction.
• Screening establishes what it establishes and nothing wider. Sponsor screening does not assess past performance, prior returns, valuations, projections, models, commercial merits, financial condition, solvency, capacity to perform, or suitability for any member. It blocks disqualifiers and flags what it finds. It does not stand between a sophisticated allocator and their own diligence, and does not hold itself out as having done that work.
• Compliance outside the United States is not addressed.

Credibility established once, by someone who already knows them. Carried by them, and proved to anyone.
This is the new standard. This is InvestorPass.