Certification guidance
Security and Privacy
A public certificate check is deliberately limited. It is separate from private evidence, authenticated accounts and control of the robot.
Does control of a key establish legal ownership?
No. A signature can demonstrate control of admitted key material in a particular exchange. It does not by itself determine legal title, agency, custody or an ownership dispute.
Does a robot UUID prove a physical chassis?
No. The Profile defines the admitted identity and evidence. The current logical-identity claim must not be presented as universal hardware-root attestation or proof that an identifier cannot be copied.
Can anyone read the robot’s private record?
No. Confirming the public certificate claim does not grant access to the underlying record. The public tier exposes a bounded result and signed verification material, not a private event timeline. Full-record review requires separate Owner authorization.
What becomes public, and what stays private?
Only fields admitted by the signed public artifacts and membership registry are public. Account relationships, private evidence, recovery information, administrative work and economic records are separate authorized data. Secrets, credentials, private keys and private notes do not belong in public artifacts.
Can a certificate become a remote shutdown mechanism?
No. GRRC certification and public verification provide no robot command, update or shutdown path. The robot’s own response to an integrity fault is its internal protection, not a remote command from GRRC. A certificate cannot authorize a previously blocked decision to execute.
What does an Owner login authorize?
Only the actions admitted to that identity and organization. It is not a certifier identity and cannot rewrite signed certificate history, inspect another organization or use the certifier signing key. Public verification needs no Owner login at all.
Where is the certifier signing key?
In separate certifier custody, outside the administration application and robot. The application can prepare and observe work; it does not hold, reach or proxy that key. Public verification uses public trust material rather than a signing or decryption secret.
Can an account suspension silently revoke a certificate?
No. Suspension and payment state concern service access. Certificate withdrawal and signer withdrawal are separate signed lifecycle matters. An administrator’s database change is not a substitute for an observable public trust result.
Can verification work if GRRC is unreachable?
Yes, with the complete saved inputs and trusted verification material. The offline method is the floor; hosted verification is a convenience. The signed statements still have an evidence basis and dates, so a saved bundle does not prove facts newer than those it carries. See How to Verify.
Does an unavailable result mean the certificate was revoked?
No. It may mean the identifier is wrong or no public bundle is provisioned for it on that service. A network failure is not a signed revocation either. Read the actual result and, where available, check saved trusted inputs independently.
What should I enter in the public verifier?
Only the robot UUID requested by the lookup. Do not enter a password, passkey, private key, payment information, private evidence or a recovery secret. The public lookup address contains the public identifier you submit. The Privacy page explains the site and verification endpoints.