Every snapshot, hashed. Re-hash it yourself.

Every dated snapshot Fonteum publishes is SHA-256 hashed and attested at write time. Re-fetch the upstream source archive, run shasum -a 256, and compare to the hash on file at /verify/[snapshot_id]. A 64-character match means the bytes you read are byte-exact to what we ingested.

0 attestations on file across 0 source families. Foundation layer for the Certificate-Transparency-style attestation chain — hashes ship first, chain semantics layer on top once 30+ snapshots have accumulated.

How to re-hash a snapshot →

Security & compliance

What we run on, and what we hold.

SOC 2: Type 1 audit in progress, target September 2026.
Infrastructure: Hosted on Vercel (edge network). Data warehouse: Supabase (PostgreSQL). All data at rest encrypted. All data in transit TLS 1.2+.
Data scope: Public-domain federal regulatory records only. No PHI. No PII beyond what appears in federal public records. No BAA required.
Snapshot integrity: Every ingestion run produces a SHA-256 hash stored in snapshot_attestations. Verify any snapshot at /verify/[id].
Security contact

Recent attestations

Attestation backfill is in progress — first batch ships with the v2026.06 methodology release.

Open & verifiable

Live FHIR R4 API, a public SHA-256 attestation chain, and an open methodology — every Fonteum value is traceable to its federal source. The hashes above are how a verifier proves it.

FHIR R4 API

US Core 6.1.0
live · /api/fhir

Attestation chain

SHA-256 verified
public · /chain

Methodology

version v2026.05.0
public · /methodology

Provenance

8-tuple per field
source · date · confidence

Source registry

22 federal families
all primary-source · /sources

security@fonteum.com

Compliance posture

Compliance posture

Every snapshot, hashed. Re-hash it yourself.

What we run on, and what we hold.