EXCLUSIVE ACCESS
InvestorPass

The InvestorPass Protocol

Version 2.3.0, issued by InvestorPass LLC, dated October 30, 2026. It changes who may check a credential and adds a way to sign in with one. A credential is now checked by an active licensee, and the licensor serves the issuer register and the revocation list only to an active licensee's signed call; a list is good for 24 hours. A licensee may sign its members in on its own website. Every certificate issued under an earlier version reads the same under this one.

Version 2.2.0, dated October 24, 2026, corrected version 2.1.0 on one point of fact and changed no rule. Sections 8 and 9 said that a deployment's verification files never reach the licensor and that the licensor holds no person. That stopped being true when the papers vault was built and deployed on October 23, 2026: the papers written about a person are held in the licensor's vault, sealed under the licensee's own key, which the licensor does not hold. Every certificate issued under version 2.1.0 reads the same under this one.

Version 2.1.0 changed two things in version 2.0.0. A credential may rest on a second basis, the licensee's own itemized attestation (section 1), and the seal a door receives no longer states a basis at all (section 5). Every certificate issued under version 2.0.0 reads the same under version 2.1.0.

Version 2.0.0 superseded version 1.0.0, the first version the licensor issued in its own name, and changed one thing at the root: a credential is held for life. The certificate no longer carries an expiry, which made it a new format, and a credential ends only by revocation. Every certificate carries the version of this document it was issued under, and every deployment reads that version from one place.

This document is normative for every deployment that issues certificates against the Standard. Where it says must, a deployment that does otherwise is not operating under the Standard. The Standard is this Protocol together with the verification policy it makes normative.

1. What It Is For

A credential that a person holds a verified standing at a stated level: made once, held for life, presented at any door that honors it, and checkable by any active licensee at that door without a register of members anywhere. The Protocol fixes what such a credential is, how it is made, how it is checked, how it ends, and what may never be held about the person who carries it.

The verification is never a deployment's unrecorded judgment, and never a machine's. InvestorPass reaches no verdict about anybody's money. A credential records a named person's attestation, given under that person's own name and kept, on one of two bases and on no other:

  • A licensed professional's attestation. A named, licensed professional the applicant already engages attests to the standing, and the deployment records where that professional's license was checked.
  • The licensee's own itemized attestation. The licensee's signatory, the individual who signed on the licensee's behalf the license under which its deployment issues against the Standard and whom the deployment names by email address, or, for a pilot room, the individual who signed that room's pilot license, for that room's applicants only, on a relationship with the applicant of at least one year, attests on their own knowledge by answering each of the four statements of section 3 Yes or No: that they know the applicant well enough to attest that the applicant's claims are accurate; that the qualifying platform holds true assets under management exceeding the rung of the room named; that the applicant is its designated authorized representative; and that the applicant holds decision-making authority over the deployment of its capital or assets. Every answer must be Yes. The answers are stored in the deployment's own verification store, and the licensee answers for the truth of what it attests: an attestation is a breach where it is untrue and the signatory knew it, or failed to take reasonable care to confirm it. It is not held to the recency a professional's attestation must meet at approval.

Both bases make one credential. It is the same format and the same claim type on either basis, it is honored at every door whose bar it meets, and nothing on a certificate, a seal, a pass, a holder's page or a check tells the two apart. No door may decline a credential for the basis it rests on.

2. The Ladder

One list, used by every deployment, in this order:

5M · 10M · 20M · 50M · 100M · 250M · 500M · 1B+

A rung is a level on the ladder. An applicant chooses the rung they wish to be verified for, a deployment states the rung it verifies to, and a room states the rung it admits at. A rung is a position on a public ladder and never a figure about a person: no amount, no statement, no holding and no structure is stored anywhere under the Standard. A room learns that its bar was cleared. It does not learn by how much.

The amount is never shown to a person. The certificate carries its rung inside the data both signatures cover, where machines read it. What a person sees, anywhere under the Standard, is whether a credential clears the bar asked, and never the rung.

3. How A Certificate Is Made

  1. The applicant chooses the rung, and that choice is printed into what is attested.
  2. The standing is attested on one of the two bases of section 1. On the first, a licensed professional the applicant already engages, never the deployment, attests that the qualifying platform holds true assets under management exceeding the figure of the rung, that the applicant is its designated authorized representative, and that the applicant holds decision-making authority over the deployment of its capital or assets. Where a license must be checked, it is checked against the regulator's own published register and never against a search engine. On the second, the licensee's signatory answers the four statements below, each Yes or No, and every answer is Yes.
  3. A named human at the deployment cuts the certificate, and the deployment signs it with its own enrolled key.
  4. The licensor counter-signs it. A certificate carrying only the issuer's signature is provisional and fails verification in those words. The licensor counter-signs only a certificate in the format of section 4, because no deployment issues a time-limited credential, and only for an issuer that is active in the register and still within its issuing period (section 6). The certificate must name as its issuer the deployment the register enrolled its key under, and its identifier must be the digest of what was composed.

The licensee's own attestation. The licensee's signatory answers each of these four statements Yes or No. No other person at the deployment, administrators and pilot seats included, gives it.

  • I know the applicant well enough to attest that the applicant's claims are accurate.
  • The applicant's qualifying platform holds true assets under management exceeding the rung at which the room named in this attestation admits.
  • The applicant is the qualifying platform's designated authorized representative.
  • The applicant holds decision-making authority over the deployment of the qualifying platform's capital or assets.

The attestation is stored in the deployment's own verification store. It records the four answers, the date the relationship began, which is at least one year before the answers are given, and the room it names; the certificate states that room's own rung, which is never shown to the person answering. How the signatory knows the applicant is written in words and filed as the paper of the record's ledger line. The deployment's administrator is emailed for each approval made on it, and the person's own statement lists the answers and their dates, never the rung and never who answered. A No on any statement is the signatory's own answer, and no certificate is made on it. The attestation has no time limit: it is not held to the recency a professional's attestation must meet when the file is approved.

4. What A Certificate Is

Format investorpass-certificate/2. Composed at issue: format, protocol_version, issuer, key_id, type, subject, basis, rung, issued_at and registry, with holder_key, the public key of the holder's own device, wherever the credential is bound to one. Then cert_id, derived from what was composed; sig, the issuer's signature; and countersig_key_id and countersig, the licensor's, added afterwards and outside what the issuer signed.

  • A credential is held for life. A version 2 certificate carries no expires_on field at all, and one that carries it, whatever it holds, fails verification. Once a person is verified they stay verified, and nothing about the credential is ever renewed.
  • Revocation is the only ending. A credential ends when it is itself revoked, which the signed revocation list carries, or when the counter-signing key that endorsed it is revoked (section 6).
  • A version 1 certificate keeps its date. A certificate in the format investorpass-certificate/1, issued before this version, carries an expires_on day and is held to it until it is reissued in the format above; one that states no such day fails verification.
  • The subject is an opaque reference. The format refuses anything shaped like prose, a name or an address. The mapping from reference to person stays inside the issuing deployment.
  • basis is a list of digests of the evidence the issuer holds, whether a professional's attestation or the licensee's own. The evidence itself never travels, and nothing in the certificate says which of the two it is.
  • There is no personal data in a certificate. The licensor signs a document, not a person.

5. How A Certificate Is Checked

In order, and any failure is a failed verification, said in words that say why:

  1. the issuer register verifies: its sequence, its linkage and every signature on it;
  2. the issuer's key is in the register, and the issuer's signature verifies against the key the register holds for it; a successor (section 7) carries no issuer signature, because no issuer signed it, and is checked on the licensor's counter-signature alone;
  3. the claim type is within the issuer's enrolled scope;
  4. the licensor's counter-signature verifies against the counter-signing key the register names, and that key has not been revoked; a retired key still verifies what it signed;
  5. a claim of standing states a rung, and the rung is on the ladder;
  6. the version rule: a certificate in the format investorpass-certificate/2, or a successor in the format investorpass-certificate-successor/2, carries no expiry; any other certificate carries an expiry day and is unexpired;
  7. the subject is an opaque reference, and a successor names the certificate it succeeds and carries no issuer signature;
  8. cert_id is the digest of what was composed, so no identifier can be borrowed from other paper;
  9. the certificate is not on the licensor's signed revocation list.

A check names the issuer as the deployment the register enrolled the key under, never as the text the certificate carries in its own issuer field.

The issuer's standing is not a step. An issuer whose enrollment is suspended or revoked stops issuing, and every credential it issued before then stands: a credential is portable and permanent, and it outlives every license. A check fails a certificate for its issuer only where the issuer's key was never in the register or, for any certificate but a successor, the signature does not verify against it.

A check is run by an active licensee, against the issuer register and the licensor's signed revocation list, which the licensor serves only to an active licensee's signed call. A list is good for 24 hours from its signing; a checker holding an older one gives no answer. A check asks nobody about the person. No step reads the basis a credential rests on, because nothing the check reads states it. A refusal is a fact about paper and never a statement about the person who presented it.

Signing in on a licensee's own website. A licensee may sign its members in on its own website through a sign-in box the licensor serves, embedded only by the websites the register names. The member's paired device signs once. The licensor checks that signature and answers in a form it signs, good for 90 seconds, stating an identifier for the person that is the licensee's own, whether the person clears the licensee's bar, and which licensee issued the credential. It never states the person's level, name or device key. It states the person's subject reference and certificate identifier only to the licensee that issued the credential, which already holds both and uses them to keep checking the revocation list while the person stays signed in. The licensor keeps no record of the sign-in.

What a door receives. At a door the holder presents a seal the licensor signs, carrying the bar the room asked for and never the holder's own rung. The seal names the certificate, so the revocation list reaches it, and the issuing deployment. It comes in two formats:

  • investorpass-rung-seal/1 carries the certificate's expiry day, and the door holds it to that day.
  • investorpass-rung-seal/2 names a credential held for life, yet the seal itself is short-lived: it carries a signed not_after a day after it was minted, and a door refuses it after that instant or without one. Seals are minted fresh each time the holder opens their pass, so a device that is removed stops opening doors within a day. A seal minted under this version carries no relationship field and states nothing about the basis the credential rests on. A seal minted before this version that still carries relationship as false keeps clearing until its own not_after, a day after it was minted, and a door never acts on its value; a relationship field holding anything but true or false is refused. No door declines a credential for the basis it was issued on.

6. The Issuer Register

The root record of every deployment licensed to issue against the Standard, and of the counter-signing key that endorses their certificates: a signed, append-only log held by the licensor and never delegated. It records each issuer's key, scope and standing; a change of standing is appended with its reason and never edited in. No deployment is enrolled on paper nobody signed: an executed license, its date and the digest of the document are recorded with the enrollment.

An enrollment may carry an issuing end, issuing_ends_at, written as an instant in UTC to the second (YYYY-MM-DDTHH:MM:SS+00:00) and never as a day: the day and the place it is counted in are the writer's, so every reader meets the same instant. The end binds the deployment, not one key: a successor key the deployment is enrolled under carries the same end. From that instant the licensor counter-signs nothing the deployment sends, and every credential it issued before then stands. A renewal line moves the end or, carrying none, lifts it. A renewal names the issuer key it renews and carries its own executed license, its date and its digest, as an enrollment does; it never reinstates a suspended or revoked issuer, and a revoked issuer is not renewed.

The register holds no member data of anyone's and cannot read into a deployment. Suspending or revoking an issuer's enrollment stops it issuing, immediately, without touching that deployment's data or any credential it already issued, whatever the cause of the revocation. A single certificate ends by its own revocation, which its issuer asks for or the licensor makes itself, and every checker refuses a certificate the signed revocation list carries. Revoking a counter-signing key ends every certificate that key endorsed, because a key whose private half was taken leaves nobody able to tell the licensor's counter-signatures from a thief's; honest paper is counter-signed again by its successor.

7. Succession

A holder who loses the device that carries their credential recovers it with a recovery secret shown to them once, at pairing, and to nobody else. Using it retires every key that stood before, revokes the superseded certificate, and mints a successor, format investorpass-certificate-successor/2, signed by the licensor, which a checker already trusts because the licensor signs the register every check reads first. A successor to a version 1 certificate, format investorpass-certificate-successor/1, keeps the expiry day of the certificate it succeeds. The licensor learns nothing new in the act: it checked a signature against a key it already held. Nobody at the licensor ever decides that a person is who they say they are, because nobody at the licensor has ever known.

8. Roles

  • The Operator is the named human authority of a deployment and holds every decision the Standard reserves to a human: authorizations, refusals and revocations. Every such decision records who made it.
  • The attesting professional is engaged by the applicant, is licensed, and is checked against the regulator's own register. The professional confirms; the deployment records.
  • The licensee's signatory is the individual who signed on the licensee's behalf the license under which its deployment issues, whom the deployment names by email address, and is the only person who may give the licensee's own attestation, save that a pilot room names the individual who signed its pilot license, who may give it for that room's applicants only. Nobody else may give it, administrators and pilot seats included. The signatory attests on their own knowledge of a relationship of at least one year, the answers are stored in the deployment's own verification store, the administrator is emailed for each approval made on them, and the licensee answers for an attestation that is untrue where the signatory knew it or failed to take reasonable care to confirm it.
  • Screening refuses or refers, and never approves. Nothing automated grants standing.
  • The licensor holds the Standard, the register and the root of trust, counter-signs every certificate, holds no person's name, and keeps each person's papers sealed under the key of the deployment that verified them, which it cannot read.

9. What Stays With A Deployment, And What The Licensor May See

Each deployment's members, their names and its records live in that deployment's own systems and never cross to another deployment. They do not cross to the licensor in a form it can read: the papers written about a person are held in the licensor's vault, each sealed on the deployment's own worker under a vault key the licensee generates and sets itself and the licensor never receives, so the licensor keeps custody of what it cannot read. The names stay with the licensee, and every paper the platform writes itself carries no person's name. The licensor may audit a licensee for compliance with the law and with InvestorPass policy, and may review an individual member's file only when a report is made that directly concerns that member. Such a review happens in place, inside the licensee's own systems, reaches only that member's file, keeps no copy, and is written into that member's own statement like every other disclosure.

What otherwise travels to the licensor is totals and never rows: members per rung, event sign-ups by rung, deal views by rung and region, with no name, contact detail, reference or key among them; any total under five is given as fewer than five; regions are no finer than a state or a country, and time no finer than a week or a month. The licensor uses these totals only in aggregate, never tries to identify anyone from them, and holds anyone it shares them with to the same.

10. Marks, The Hub And The Rings

Every governed file of a deployment carries one of four marks: protocol, the Standard itself, which every deployment carries; product, which ships with every release; instance, one deployment's own, which never crosses a deployment boundary; personal, one person's own, which never leaves. Release tooling filters on the mark mechanically.

Every governed file points at one hub, and the hub points at every governed file: one step each way. The hub is generated from a plain list of sources, records a digest of every source at every build in protected history, and is written to a second repository after every commit. It needs no key of its own, so nothing that can be lost can freeze it. Its check proves the hub can still be written, not only that it verifies, and a failure stops work in plain words rather than refusing work silently.

Three rings hold a deployment's records: protected history on a remote where rewriting is refused; dated snapshots whose digests are committed into that history; and a copy held where no automated process has credentials, refreshed on a stated cadence. All three belong to the deployment.

11. Enforcement

Machinery rather than promises: a calibration suite of deliberate failures that must each fail loudly, run on every cycle; divergence checks on everything generated; verification of the register on every cycle; and a drift test that fails the suite whenever the hub, the map or a governed text moves without its counterpart. A fixture that passes by not detecting its break is treated as an alarm that does not ring.

Honest limits, stated as part of the Standard: consistency checks cannot prove truth; a signature proves who signed, not that what was signed is accurate; nothing technical confirms a signatory's answers, which rest on the licensee's own knowledge and its answer for their truth; and nothing technical prevents an unlicensed deployment operating outside the register. Those joints are contractual and human, and no deployment may represent them as mechanical.

12. Versioning

The Protocol is versioned in three numbers. A released version is frozen; a change lands in the next version. Every certificate carries the version it was issued under, and every deployment reads the version from one place, so drift between deployments is visible rather than assumed. This is version 2.3.0. A certificate issued under version 2.2.0, 2.1.0 or 2.0.0 reads exactly as it did, and a checker under this version reads it without distinction. Version 1.0.0 stands for the certificates issued under it, which keep the expiry they carry until they are reissued, and a checker under this version reads both.