About Proof Holdings

Bots requested thousands of SMS codes that those apps had to pay for — a fraud known as SMS pumping. It cost them a five-figure sum. So we turned the check around: the user sends us the code instead of receiving one (we call it Reverse OTP). There is no code for bots to request, no incoming code for a scammer to talk out of the user, and nothing sent out for bots or rogue automation to run up a bill on: the user sends one message, and the business pays only for proofs that succeed. Delivery improves too, because nothing has to be sent to the user and filtered on the way.

Every year, banks and fintech partners doing due diligence asked those companies to prove their domains were really theirs — with screenshots of the registrar account. A screenshot is easy to fake. A signed proof is not.

Verifying an email address meant running a second system, with its own providers to pay. Now it is the same API call as the phone.

Linking several social accounts builds a stronger identity and gives users more ways to sign in. Each network meant another integration to build and maintain. Proof Holdings will treat a social account like a phone or an email: one more thing a user can prove they control, on the same API.

In the crypto apps, a user gives a wallet address and asks for funds to be sent there. Before moving money, the team had to know the wallet was really the user’s, and all it had was their word; a mistyped or planted address is money gone for good. A wallet proof, signed with the wallet’s own key, is next on the same API.

Any automation can take a risky step — a script moving money, a pipeline deploying, an AI agent sending mail. Now that step stops until a person says yes, on Telegram or WhatsApp, where people already are, or on any other channel, on request. Nothing passes without the yes, so it works as a firewall in front of the action. The question and the answer are encrypted end to end — we cannot read them — and the yes is signed, so it can be proved later.

Software now installs software: a developer runs npm install, an AI agent connects to an MCP server. Anyone can publish either under your company’s name, and nothing inside the package can prove who stands behind it — every field in it was written by whoever uploaded it. So a fake copy gets installed next to the real one. One fake server worked fine for fifteen releases, then started copying every email to its author. Proof of Delegation is a signed statement from the company’s own domain, which it has proven it controls: this package, this server, is authorised to act in our name. Anyone about to install it can check that statement, and the company can withdraw it the moment it stops being true. The check can also run by itself: a small package the publisher installs in its own server asks us again whenever its tools are called whether the delegation still stands, and once it is withdrawn the server starts refusing its own tools, so its users are cut off even if they never check. It cannot stop a fake copy, which carries no delegation at all — catching that is what the check before installing is for.

The people around our founder get calls from someone claiming to be him. Proof of Me lets the real person prove it is really them.