What a third-party risk review asks, answered before it is asked. No certification is claimed that does not exist; no capability is described that is not running.
Invarians is operated from France, under French and EU law. A dedicated legal entity and an LEI are put in place at first contract; the formation file is prepared in advance so this step takes weeks, not months.
Capture and processing run on infrastructure in the European Union (Germany). Data is stored in the European Union (Frankfurt). Edge delivery uses a global network.
Alchemy (blockchain RPC data), Supabase (database, EU Frankfurt), Circle Iris API (message attestation data, as a source), Cloudflare (edge delivery), Hetzner (compute, Germany). Clients are notified before this list changes.
Today, a third party cannot independently verify Invarians' own records: they are HMAC-signed, which guarantees integrity between the parties. Third-party verifiable signatures and public anchoring are the next version, built with our first design partner.
Archived Circle attestations remain verifiable against Circle's published keys; that verifiability is Circle's property, which the archive preserves.
Signed route records and evidence extracts are retained for at least five years. Full-resolution capture (the 10-minute observations) is kept twelve months in the live database, then archived to separate cold storage. Extracts delivered to you are yours to retain under your own schedule.
On request or at end of contract, your records are returned in an open, documented format (CSV or JSON), with the signature material needed to check their integrity.
Invarians does not operate a rail, does not trade, does not act for agents, and receives no payment from the operators of the corridors it records. It has no position in the routes it measures. This is what "independent" means on these pages.
The service measures infrastructure. It processes public on-chain identifiers (transaction hashes; sender and receiver addresses on CCIP lanes) as pseudonymous data, for infrastructure measurement only. No profiling of individuals, no cross-referencing with other sources. A data processing agreement is available on request.
Operational incidents affecting the service are notified to affected clients by email, with a commitment in hours defined in the service agreement. Incident contact: contact@invarians.com.
Security reports and complaints go to the same address, contact@invarians.com, and are acknowledged within five business days.
The calibration methodology and its backtests are published; the backtests are reproducible from public data. Measurement windows and freshness budgets are declared with the data. Degraded instrument windows are flagged in the record and kept out of published statistics.