Cryptographic assurance, engineered for enterprise trust
HashOrigin™ is the cryptographic foundation underpinning document integrity across the Twala platform. It combines advanced cryptography, blockchain anchoring, and established digital signature standards into a tamper-evident, independently verifiable chain of trust for every document processed through Twala.
- 01SealThe Twala Platform Seal, a digital signature checked with Twala’s X.509 certificateValid · Trusted · LTV
- 02FingerprintSHA-256 of the sealed file, recorded by Twala—
- 03BatchEvery 15 minutes, up to 256 hashes into one keccak256 Merkle root—
- 04AnchorThe root written to Twala’s contract on Polygon, in its own transaction—
- 05VerifyAnyone can check the file, with or without Twala—
HashOrigin in five stages: a document is sealed with the Twala Platform Seal, the sealed file is fingerprinted with SHA-256, the fingerprint joins a Merkle tree batched every 15 minutes, the tree’s root is anchored on Polygon, and anyone can then verify the file.
Digital signature integration
When a document is sealed, Twala converts it to PDF/A-2b and signs it with the Twala Platform Seal: a digital signature over a SHA-256 digest of the finished PDF, made with Twala’s private key. It is applied last, after the organization’s seal when the team has one, so it covers every signature on the document.
Anyone can check the seal with Twala’s X.509 certificate, which carries Twala’s public key: a PDF reader recomputes the digest from the file and confirms it against the signature, so any modification is detectable. The fingerprint Twala records and anchors is taken next, from the sealed file.
The process is aligned with the requirements of electronic signature laws, including the Philippine Electronic Commerce Act, the Supreme Court Rules on Electronic Evidence, and comparable regulatory frameworks internationally.
Try it: ₱45,000.00 → ₱46,000.00 is a one-character change.
48dc8183f8a936bb43181d4d81c947e335514413f6955bac59631c7c3dee254148dc8183f8a936bb43181d4d81c947e335514413f6955bac59631c7c3dee2541Fingerprint matches the original
Computed in your browser. Nothing you type leaves this page.
Cryptographic fingerprinting
Once sealed, every document is fingerprinted: Twala computes the SHA-256 hash of the sealed file, a fixed-length digital fingerprint that stands for this exact file and no other, and records it.
Even the smallest alteration to a document produces an entirely different hash, a reliable way to detect unauthorized changes. Change a single character in the demo and roughly half of the 256 output bits flip.
Merkle tree architecture
To secure these fingerprints at scale, every 15 minutes Twala gathers the hashes recorded since the last run, up to 256, into a Merkle tree, a cryptographic structure purpose-built for efficiently validating large volumes of data. Each hash becomes a leaf by hashing its 32 bytes with keccak256, and the leaves are paired and hashed with keccak256, level by level, into a single root that summarizes every document in the batch.
The integrity of any single document can be verified independently by tracing it back to the root hash. If a document is altered, the change in the root hash immediately signals tampering.
Select a document above to edit its text.
The recomputed root matches the anchored root. Select a document to edit it.
InteractiveSimplified to four documents; a real batch holds up to 256, each leaf being keccak256 of a sealed document’s SHA-256 hash.
Recorded once, checkable by anyone, for good
The root of each batch is written to Twala’s contract on the Polygon blockchain, in a transaction of its own. Once recorded, it cannot be altered: a permanent, independently auditable record.
Each batch stands on its own. The contract stores every root with the time of its block, and anyone can ask it whether a root was anchored, and when. Every Polygon block produced afterwards buries that transaction deeper, so the record only becomes harder to dispute over time.
- Your document’s batchAnchored09:15 PHTMerkle root
0xaeceec…f597Documents214Block58,429,318Transaction0x7859…675b - +22 more batches anchored since
- 10:00 PHTAnchoredMerkle root
0x8e2a91…8a61Documents182Block58,430,671Transaction0x92f5…66e5 - 10:15 PHTAnchoredMerkle root
0xf65f6c…febbDocuments69Block58,431,122Transaction0x0c75…2b62 - 10:30 PHTAnchoredMerkle root
0x1dd421…6701Documents69Block58,431,566Transaction0xb18e…456c
Your batch’s transaction is 2,262 Polygon blocks deep, and every new block buries it further. Each batch stands on its own: the contract keeps each root with its block time, and no root depends on another.
Underlying cryptographic standards recognized internationally
HashOrigin™ is built on a foundation of internationally recognized cryptographic and digital signature standards.
- SHA-256Secure Hash Algorithm (SHA-256)The document hash: a fingerprint of the sealed PDF, recorded and anchored
- keccak256Keccak-256Builds each batch’s Merkle tree, the way the anchoring contract checks it
- X.509X.509 certificatesBehind the Twala Platform Seal and organization seals; Twala’s comes from its private certificate authority
- RFC 3161Trusted timestampsA timestamp authority’s token inside each signature
- PDF/A-2bArchival PDF (ISO 19005-2)Sealed documents are converted before they are signed
- LTVLong-term validationRevocation evidence embedded in the signatures, when every signature has it
- PolygonPolygon blockchainWhere each batch’s Merkle root is anchored, on Twala’s contract
- TLSTransport Layer Security (HTTPS)Encryption in transit across the platform
Interoperability with Public Key Infrastructure
Built on blockchain-based innovation, HashOrigin remains fully interoperable with traditional PKI systems through the widely adopted X.509 certificate standard. Twala is also a member of the Cloud Signature Consortium (CSC).
The Twala Platform Seal is a standard digital signature, so Adobe Acrobat and other PDF readers that check signatures can confirm the document has not changed since it was sealed. Whether a reader also shows the signer as trusted depends on the authorities it trusts; Verify a document checks the certificate against Twala’s trust registry.
Twala also supports Long-Term Validation (LTV): each signature carries an RFC 3161 timestamp and the revocation evidence for its certificate, embedded in the signed PDF, so it stays checkable after the signing certificate has expired. A document is marked LTV-enabled only when every signature has it.
- CertificateThe X.509 certificate chain behind the seal
- Revocation statusOCSP or CRL evidence the certificate was valid at signing
- TimestampAn RFC 3161 token of when the seal was applied
Verifiable long after the signing certificate expires
- X.509Standard PKI certificates, so a PDF reader that checks digital signatures, such as Adobe Acrobat, can check the seal
- RFC 3161Each signature carries a timestamp from a timestamp authority
- LTVLong-term validation: revocation evidence embedded in the signatures, when every signature has it
- PDF/A-2bSealed documents are converted to the archival PDF standard before they are signed
Blockchain anchoring, X.509 PKI, RFC 3161 timestamps, long-term validation, and PDF/A-2b together let enterprises adopt Twala’s document security without giving up compatibility with existing digital certificate infrastructure or long-term document validity.
Infrastructure and resilience
Twala’s platform runs on Amazon Web Services in Asia Pacific (Singapore), engineered for high availability and operational resilience, to maintain service continuity and safeguard data integrity in the event of unplanned disruptions.
- Disaster Recovery PlanA formal plan that safeguards data integrity and service continuity
- Business Continuity PlanKeeps business-critical operations running for enterprise clients
- Multi-AZ databaseAmazon RDS across availability zones in ap-southeast-1, with a standby kept in sync
Assurances built for regulated enterprises
Legal compliance
Aligned with the Philippine Electronic Commerce Act, Supreme Court Rules on Electronic Evidence, and comparable international electronic signature frameworks.
Tamper-evidence
Any unauthorized modification to a document is immediately detectable.
Independent verifiability
Blockchain anchoring enables third-party verification of document integrity without reliance on Twala as a single point of trust.
Long-term security
An anchored root cannot be altered, every new Polygon block buries its transaction deeper, and long-term validation keeps signatures checkable after their certificates expire.
Standards interoperability
Works with public blockchain tooling, standard X.509 PKI, and PDF readers that check digital signatures, such as Adobe Acrobat.
Check a document yourself
Check any Twala document on the verification page, or verify it with your own tools using its anchor proof.
Read the full technical overview on hashorigin.io
Any further questions? Feel free to reach out to our team.