Bonded Lot

Verify the record

Every laboratory result Bonded Lot records is sealed into a chain. Each result's fingerprint covers its own content and the fingerprint of the result before it, so changing, removing or reordering a sealed result breaks every fingerprint after it. At least once a quarter, and whenever a correction is published, two independent timestamping authorities each sign the newest fingerprint, which proves the chain up to that point existed at that time. You can check all of it yourself, without trusting Bonded Lot.

Chain head

fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95

As of 27 October 2026, 18:23 UTC

No result has been sealed yet, so the head is the chain's starting value.

Timestamps

2 October 2026, 13:09 UTC
DigiCert signed the chain's starting value, before any result was sealed.fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95Download the token
2 October 2026, 13:09 UTC
Sectigo signed the chain's starting value, before any result was sealed.fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95Download the token
30 September 2026, 22:12 UTC
DigiCert signed the chain's starting value, before any result was sealed.fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95Download the token
30 September 2026, 22:12 UTC
Sectigo signed the chain's starting value, before any result was sealed.fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95Download the token

Downloads

chain.jsonl
Every sealed result's id and fingerprints, in chain order, one per line. Results on lots never released are included as fingerprints, with nothing that identifies them.
verify.mjs
The checker: a single file that needs only Node.js. The same file is kept in every quarterly archive.

How to check it

  1. Install Node.js 20 or newer.
  2. Put chain.jsonl, verify.mjs and the timestamp tokens you want to check in one folder.
  3. In that folder, run the command below.
node verify.mjs --published .
  • Each row's row_digest is the SHA-256 of its prev_digest, a colon, its payload_digest, a colon and its id.
  • Each row's prev_digest is the row before's row_digest. The first row's is the SHA-256 of the text the-bio-logic-foundation:result-chain:v1, which is:fdf50aa86ec6ea5621c4de5ead8d2b2f354382dacdc699a02f1487434a409d95
  • Each token signs a fingerprint that is a link of this chain, its authority's signature is genuine, and its certificates reach a root your computer already trusts.

It finishes with one of three words. VERIFIED: every link checks, and a timestamp ties the chain to its time. FAILED: something does not match — evidence of alteration. NOT ANCHORED: the links check, but your computer does not trust the timestamp authority's root. Get that root yourself, confirm its fingerprint below, and run the command again with --trust root.pem.

You do not need the checker. The links are plain SHA-256, and the tokens are standard RFC 3161, which any time-stamp tool can read.

Roots

DigiCert
DigiCert Trusted Root G455:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88
Sectigo
USERTrust RSA Certification AuthorityE7:93:C9:B0:2F:D8:AA:13:E2:1C:31:22:8A:CC:B0:81:19:64:3B:74:9C:89:89:64:B1:74:6D:46:C3:D4:CB:D2

What this does not show

  • What any result says. The chain is published as fingerprints; each result's values are on the record its lot's code opens.
  • That no other result exists. A timestamp proves the results it covers existed then, and results sealed after the newest timestamp are not covered until the next one.
  • Whether a result should have been published. That depends on whether its lot was released, which this page does not record.
  • Whether an authority's certificate was later revoked, which needs the authority's own service to check.

Published as measured. Bonded Lot does not rate or judge results.