# Why you don't have to trust Redeal

Most services ask for trust and offer promises. Redeal is built so that
cheating is structurally impossible, then it hands you the tools to check.
Everything below is a mechanism, not a policy.

## Six mechanisms

1. **The engine is open.** No floats, no external data feeds, simple enough to
   re-implement from prose. Each algorithm ships with published test vectors
   generated by an independent Python reference implementation, and the engine
   matches them bit-for-bit. The source repo opens as a launch act; until then,
   `GET /v1/algorithms` lists every algorithm with its input contract, live.
2. **Inputs are sealed until lock-in.** Parties commit SHA-256 hashes before
   anyone reveals anything; the protocol refuses to compute until every
   commitment is in. Revealed inputs are stored encrypted at rest
   (AES-256-GCM) and never appear in certificates, logs, or any third-party
   telemetry. See https://redeal.dev/trust/data-policy.
3. **Computation is deterministic.** No floating point, no external price
   feeds, no AI anywhere near the engine. Randomness comes only from inputs
   sealed by the parties plus the public drand beacon at a round pinned before
   the deal opens. Given the same inputs, any machine on earth gets the same
   result.
4. **Every certificate enters a public log.** Each certificate is appended to
   a Merkle transparency log. The log is append-only; removing or altering an
   entry breaks the tree visibly. Live signed tree head:
   `GET /v1/log/tree-head`.
5. **Signatures are publicly checkable.** Certificates are digitally signed
   with ECDSA P-256 (`es256:`) by a key held in AWS KMS, and the verifying
   public key is published at `GET /v1/status`. The key lives in a managed HSM
   used sign-via-API: the server can request signatures but can never hold or
   export it. If the key ever rotates, old certificates still verify against
   the key that signed them.
6. **Flaking is on the record.** A party who commits and then refuses to
   reveal voids the deal, and the void produces a non-participation
   certificate naming their commitment hash — portable evidence for any
   reputation system.

## Trust pages

- Data policy: https://redeal.dev/trust/data-policy
- Transparency log (live JSON): https://api.redeal.dev/v1/log/tree-head
- Status: https://redeal.dev/trust/status
- How it works: https://redeal.dev/how-it-works