# Redeal status

*Canonical page: https://redeal.dev/trust/status · machine-readable:
`GET https://api.redeal.dev/v1/status`*

**Operational** — checked 2026-08-12.

## Key custody, stated plainly

- **Scheme:** ECDSA P-256 (`es256`). Every certificate signature verifies
  against the published public key.
- **Public key:**
  `es256:037ecf680d2b5dc2589b38dfb3b5a0ebc834eb4cbe26c88e48efc0d0be82ed97cb`
  (served live at `GET /v1/status`).
- **Custody:** AWS KMS (Stockholm region), used sign-via-API since the first
  deployment. The server can request signatures but can never hold or export
  the key, and every signing call is logged by AWS. No open custody caveats.

## Incidents and key rotations

- 2026-08-11 — first public deployment, signing key in AWS KMS from the first
  certificate. No incidents. No key rotations.

## What an outage would mean

Very little, for certificates that already exist: each carries its signature
and Merkle inclusion proof, both verifiable offline against the public key
and any held tree head. An outage stops new work (deals, tree heads, lookups
by ID), not the validity of anything already issued.