Trust Center

A credential platform that asks to be trusted owes an honest account of what it can and cannot currently do. This page is that account. It was last reviewed on 5 October 2026.

Current status, stated plainly

Manafide claims and their current status
Area and claim	Current status	Evidence	Limitation
IdentityManafide is not a government service and has no government approval or endorsement.	Not claimed	No government deployment, authorization, or partnership exists.	The .org domain is registered to the project, and no public institution has adopted the service.
ComplianceHIPAA, CJIS, FedRAMP, FISMA, and FERPA inform design but no conformance claim is made.	Not assessed	No certification, authorization, assessment, or institution-specific scope exists.	Framework-informed engineering is not legal applicability, contractual compliance, or authorization.
SecurityNo independent security assessment or penetration test has been completed.	Independent review not completed	Only repository-run static, database, mutation, browser, build, and restore checks exist.	Local automated and adversarial tests do not replace an independent review of a deployed system.
PrivacyOne worker cannot read another worker's Career Book through ordinary application paths.	Proven in local synthetic tests	Database suites 001 and 048 exercise worker, administrator, support, and signed-out access. Desktop and mobile journeys attempt cross-worker access through the real application.	No deployed environment, independent penetration test, or production access review exists.
PrivacyAdministrator and support roles in the application cannot read private records. People who operate the database, hosting, or running application with privileged credentials can, and Manafide does not use end-to-end encryption.	Not protected against privileged operators	Database suites 001 and 048 prove the role boundary: an administrator or support account sees no private record. Protected fields such as credential numbers are encrypted inside the database with keys the database itself holds, so its privileged roles can decrypt them.	Moving those keys out of the database has been proposed and is neither decided nor built. No production database exists yet, and custody of its privileged credentials is an open launch blocker.
PrivacyPublic profiles and shares disclose only fields the worker deliberately selected.	Proven in local synthetic tests	Database suites 003 and 048 assert exact public/share field boundaries and immediate revocation. Desktop and mobile journeys prove excluded credentials, evidence, notes, and unrelated records stay absent.	Production browser, proxy, CDN, logging, and incident-response behavior has not been operated.
VerificationA worker cannot assign or elevate their own proof level, and an upload cannot become issuer verification.	Proven in local synthetic tests	Database suite 002 and deliberate guard mutation prove proof is derived below the interface. The real upload journey stops at document-backed until a separate authorized verification occurs.	No real issuer, external reviewer, or production credential has participated.
ReadinessRequirement research, independent review, approval, and revocation are governed, but no seeded requirement is production-authoritative.	Workflow proven; authority absent	Synthetic three-person browser and database workflows fail closed when reviewer authority ends. All seeded requirement material remains explicitly marked as lacking real independent human review.	No real qualified reviewer is assigned, so real readiness decisions remain blocked.
Worker rightsA worker can correct without erasing history, export their Career Book, and revoke a share without payment.	Proven in local synthetic tests	Database suites 001, 003, 009, and 013 plus desktop/mobile correction, original-evidence download, export, packet, and revocation journeys. Owner-scoped original bytes, JSON, CSV, bounded PDF, and signed manifest outputs are exercised locally; cross-worker document download fails closed.	No standards export, independent PDF/UA audit, production trust identity, or external portability trial exists.
AccessibilityAutomated accessibility checks have been completed on the public site. Human testing with screen readers, keyboard-only navigation, magnification and voice control has not yet been completed.	Automated checks only	The complete browser gate runs the public pages and trust-review screen in desktop and mobile projects.	No manual screen-reader, voice-control, cognitive, poor-connectivity, older-device, or independent accessibility audit exists.
Data safetyManafide must not hold real professional or personal records in its current state.	Unsafe for real data	The public site holds no accounts or records, and the application is tested only with reserved-domain fictional accounts on a development host.	No real malware scanner, production recovery/key custody, independent review, mail identity, or incident operation exists.
OperationsA public informational site runs at manafide.org. The application, database, packet trust identity, and recovery proofs exist only on a local development host.	Informational site only	The public site serves explanatory pages only: it has no accounts, uploads, records, or production database.	Local build and restore success does not establish availability, disaster recovery, monitoring, or production safety.

What requirement research currently covers

This is a public research-status ledger, not a list of people who are qualified. Once coverage is published, a layer is shown as established only while its sources, requirement interpretations, independent reviewers, approvals, and review dates all remain current. If any dependency stops being valid, the status fails closed immediately.

Any role, jurisdiction, or authority layer not listed below is not researched. Missing information never means no requirement applies.

This deployment is an informational site. It holds no records and publishes no coverage, so there is nothing here to report either way. That is not a statement that no requirement applies to your work.

No seeded requirement has been independently reviewed by a real human. Development fixtures do not count as public authority, and Manafide is not yet safe for real professional records.

Your rights over your own record, once accounts open

While your account is active, and during the 30-day account-closure period, you can view and export the records and documents available in your account at no cost.
Correct anything that is wrong, and dispute anything contested.
Export everything in a portable, machine-readable form.
See who accessed your information, when, and for what purpose.
Revoke any share immediately, without explaining why.
Close your account through a documented process, and export your records before the 30-day account-closure period ends.

After that 30-day period the account cannot be reopened, and you can no longer view or export it. Closing an account does not erase its records: Manafide keeps them, and no final retention and deletion schedule has been legally reviewed or adopted yet. You can record that you want your records erased when you close, and that request is kept with your closure.

None of these are premium features and none of them will ever be. A career record you have to pay to keep is not yours.

What the people who run Manafide can see

Operating the platform is not consent to read private records. There is no administrator or support role in the application that can browse worker records. That is enforced by database policy, not by an instruction to staff, and an automated test fails if an administrator or support representative can see any private record. No production system exists yet, so this is proven in local tests only.

That is a limit on roles inside the application, not on everyone who runs the systems underneath it. A person who operates the database, the hosting, or the running application with privileged credentials can read private records, and could change those policies. Manafide does not use end-to-end encryption: protected fields are encrypted inside the database with keys the database itself holds. Moving those keys out of the database has been proposed and is neither decided nor built.

How artificial intelligence is and is not used

Software may suggest what a document’s fields say. Today the only thing it reads is the file name, never the document itself. A person always reviews the suggestion before it becomes part of a record, the original document is kept unaltered, and the suggestion, its confidence, and any correction are all retained.

Automated extraction never verifies a credential, never decides whether someone is fit for duty, and never silently changes a career record. When software does read a document’s text, that text will be treated as untrusted input: instructions written inside a document are data to be ignored, not commands.

The planned path to public accountability

Launch as an independent public-interest service. This informational site is the first part of that step.
Publish governance, verification rules, privacy rules, correction and appeal rights, and issuer standards, with independent advisory oversight.
Run pilots with credential issuers and public institutions.
Pursue formal adoption or partnership where it is warranted.
Only after formal authorization, support deployment by a government body. Not before, and never implied before.

See how verification levels work