The arrow we did not build is the one that would let us watch you.

The picture, before the prose.

The two arrows that exist.

Whoever vouched for you signs a proof and hands it to the device you hold — that is the first arrow, and it happens once, at issuance. Later, whoever is asking receives that proof from your device directly and checks it themselves — that is the second arrow, and it can happen as many times as you choose, to as many askers as you choose, without either of them talking to the other.

The arrow that does not exist.

A third connection would run from whoever is asking back to whoever vouched — a call, a log entry, a settlement record, anything that told the organization who checked your proof today. That connection was never built. Not because we would refuse to build it if a customer asked hard enough, but because the checking path described on this site makes no network call to us at all: the key document, the status list and the presentation are handed to the verifier as bytes it already fetched itself. There is nothing running here to add the call to.

We are not being generous. We built a system in which we do not have the ability. Withholding a claim is not an act of trust or of policy — the arithmetic simply does not contain it.

Measured directly against this cell this session rather than asserted: 118 of 374 published operations carry no authentication requirement at all — the public plane the checking path above actually runs on. A verifier following it never crosses into an authenticated route, which is a second way of saying the same thing the paragraph above says in words: there is nothing running here to add a call-back to.

Custody is the same argument, one layer down.

The key that proves a credential is yours is generated on your device and never leaves it. We do not hold a copy, we do not hold a recovery path around it, and we cannot produce it on request from a court, a subpoena, or a customer success ticket — because production requires possession, and possession is exactly the thing this design gives up.

Custody is an operation we cannot perform, not a promise we make.

The rule that decides where a new feature belongs.

Facts live in the systems that produce them. Verifiable statements about those facts are minted and revoked only by the trust fabric. Held statements and the consent that governs them live only on the person's device. Three sentences, and they decide without argument where a new piece of work goes — the question "where does this belong?" stops being a matter of taste and becomes a lookup.

The same split runs one layer down between organisations, not only between roles. Each organisation that issues under this architecture signs under its own key, not a shared one — a utility, a lender and a health provider are each their own root of trust. A shared-key design cannot answer "what happens when one participant misbehaves?" without touching everyone else; a per-organisation key answers it by construction: revoke one, and the others are untouched.

Before you go any further.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers.

Can ORBIS see where a credential was checked?

No. The checking path makes no call back to us, so there is nothing to see.

Can ORBIS recover a lost device's key?

No. There is no copy anywhere else to recover from.

Could that change later — could a recovery path get added?

Possibly, and if it ever does it will be a visible architectural change on this exact page, not a quiet update to a privacy policy. Nothing here is a permanent vow; it is a description of what exists today.