Evidence
Keep the record of what was true, and when.
A resolver answers what is published now. LedgerCore answers the other question — what was published before, what changed it, and on what date — as a series of retained evidence receipts.
Planned
The promise that matters
Essential canonical evidence never disappears when a paid entitlement ends.
Retention that could be revoked for non-payment would not be evidence — it would be a hostage. Ending a tier stops new extended retention accruing. It never erases what is already held as essential.
LedgerCore itself is not released. The prices and allowances below are published so you can plan; nothing here can be bought today.
The free baseline
Every identity keeps essential canonical evidence, at £0.
Kept for every identity, free ones included
- Essential canonical evidence of identity events — the discrete, material things that happened to the record.
- Kept because the identity exists, not because an entitlement is active. Identity is free. A Passport is never metered, and issuing one consults no entitlement.
- And kept afterwards. A tier that ends does not take the essential evidence with it.
Never written, at any tier
- Raw telemetry from anything your agent runs or calls.
- Request logs, traffic, prompts, completions or source code.
- Checks that found nothing changed. An unchanged state is not an event.
- Routine noise of any kind. Volume is not evidence, and a ledger you cannot read answers nothing.
Public Resolver reads and public machine-readable records are never metered, never authenticated and never counted against any allowance. Reading the current record is a separate thing from retaining its history, and the read side is never metered in either direction.
Retention tiers
More history, when the essentials are not enough.
Planned. Not open, and nothing to enrol in.
These are published list prices for a product that has not been released. There is no checkout for them on this property. If retained identity evidence is a real requirement for you, tell us what you need to be able to answer and we will tell you honestly where it is.
| Tier | Retained receipts | Monthly | Annual | Who it fits |
|---|---|---|---|---|
| STARTER | 5,000 | £9.99 | £99 ≈ 2 months free | A small estate where you want the full change history rather than the essentials. |
| GROWTH | 25,000 | £39.99 | £399 ≈ 2 months free | Several teams issuing and changing identities independently. |
| SCALE | 100,000 | £99.99 | £999 ≈ 2 months free | An estate where the history is answered from a record, not from memory. |
Prices are GBP list prices and monthly is the default. VAT is handled separately where it applies.
Not published yet: the receipt schema, the export format, the retention window in time rather than in receipts, and which events are classified essential. Those land with the release rather than being guessed at here. Technical reference will live on the Developer Gateway(opens in a new tab — developers.ecocitizenz.com).
Parent floors
A floor raises you to a minimum. It never stacks.
| Parent tier | Retention floor |
|---|---|
| Parent VERIFIED | 500 receipts |
| Parent ASSURED | 1,000 receipts |
The rule
Your effective retention is the larger of the two, never the sum:
effective = MAX(parent floor, purchased tier)
An ASSURED Parent on STARTER retains 5,000 receipts — not 6,000. The floor added nothing, because the tier was already above it.
When a floor actually matters
When it is larger than what you hold — which, given that STARTER already exceeds both floors, means when you hold no retention tier at all. A VERIFIED Parent that buys nothing here retains 500 receipts; an ASSURED Parent that buys nothing here retains 1,000.
A strengthened organisation should not have the thinnest history in the estate, and a floor is how that is avoided without anyone buying anything.
Floors arrive with a Parent tier and are not sold here. Buying retention confers no Parent tier, and no tier changes what is true about an agent. A VERIFIED or ASSURED Parent does not verify the agent. The parent organisation's identity is verified. The machine is not.
The boundary
Evidence, deliberately sparse.
It records identity events
Canonical, discrete things that happened to an identity: an issuance, a lifecycle-state change, a Parent tier change, a binding added or removed. Each with what changed and when.
It is not a log pipeline
No raw telemetry, no request logs, no traces, no prompts, no completions and no source code. If it would be noise in six months, it is not written in the first place.
Unchanged is not an event
A check that found nothing different does not produce a receipt. A ledger padded with confirmations that nothing happened is a ledger nobody can read.
It is not an audit opinion
A receipt records that something changed, not that the change was correct, authorised or wise. The record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read. Re-check the live record before you rely on it.
Your ECZ-ID does not change. Taking a retention tier, letting one lapse, or never taking one leaves every identifier, record and resolver page exactly as it was.
ECZ-ID tells you what is published and by whom. What that is worth in your context is your policy's decision, not ours.
The essentials are already yours, and already free.
Publish an identity and the canonical evidence starts accumulating without a tier, without a card, and without anything to renew. LedgerCore extends the history; it does not create the floor.