The page your compliance reviewer is going to ask for.
What the product refuses to do — no token, no cross-site graph, no KYC — each backed by a published mechanic. Most security questionnaires can be answered from the links below.
- chartereight commitments: no token, no protocol fork, no custody you didn't choose.docs.ochk.io/charter ↗
- securitywhat OC stores, what can move funds, what happens if OC disappears./security
- custodywho holds each role today, what replaces it, and what flips it./custody
- privacynine falsifiable properties, against Sign in with Google and Apple./privacy-compare
- statusevery dependency, one verdict, from one probe run./status
- recoverythe backup that runs, and what survives without us./recovery
- economicsevery sat the fee split has produced, graduation rate included./economics
- network numbersscale, economics, graduation and compliance on one live page./transparency
- scaleper-layer ceilings and the per-project rate limit./scale
- complianceeach federation against the charter's §1 properties, computed live./compliance
- operatorsevery operator key running guardian seats, as JSON./api/public/operators
- verifycheck any envelope against the published key./verify
- your dataeverything held under your identity, with a JSON export./me/transparency
- changelogwhat shipped, and when./changelog
the anti-gaming layer, in writing.
Every rate cap and review threshold is public. Legitimate users see they're well below the floor; bad actors see the model isn't worth gaming. These mirror the table on /security — both pages are canonical, neither is a summary.
bounds new-account-bonus farming. legitimate users join a few sites a week, not five a day.
monthly cap on durable state-transitions per OC identity.
prevents a malicious site from inflating one user's stack to disguise a wash flow as organic.
human review queue threshold. class B and C are self-bounded and never trigger.
a site may batch its payouts into scheduled drops, but no schedule can hold your earned share longer than this — and an open window's boundary can only ever move earlier, never later.
the trust posture, in one sentence
Every envelope your project ever signs verifies on Bitcoin headers without OC being online, against your published Ed25519 JWK and an OpenTimestamps proof. If OC disappears tomorrow — through acquisition, hostile takeover, regulatory action, or sheer attrition — your project_key is yours, your receipts continue to verify, and the protocol layer carries on. That's the whole design at the protocol layer. The charter is the public version of it; /how is the mechanic-by-mechanic walkthrough.
Your users' accrued sats are a custody question rather than a protocol one, and this page derives that answer instead of asserting it, in the same line your users are shown: “OrangeCheck holds your accrued sats during bring-up — it is operating every role until independent operators take them. Federation custody and graduation to your own keys are what replace it.” That half does not inherit the guarantee above: an accrued balance is exposed to an acquisition or a shutdown to the degree OrangeCheck holds it. /security walks that scenario by scenario; /custody carries the full posture, federation by federation.