Patent pending Independent proof for vaulted collectibles

Know your vaulted collectibles are really there
— checked every day.

Your cards, watches, and bullion sit in a vault. Truveil is the independent watchdog that proves each item is still there — and that no one has swapped it — every single day.

▶ View the demo Request a pilot
No stickers· No tags to swap· The item itself is the ID
The problem

Today, "it's in the vault" is just someone's word.

Billions of dollars of cards and collectibles sit in vaults. Right now, the only proof they're really there is the vault operator's word — plus, at best, one check a year. In between, a cheaper card can be quietly swapped into an identical case, an item can go missing, and records can be edited. No one would notice until someone asks for that exact item back.

The gap
  • A secret swap. A cheaper card is sealed into an identical-looking case. The label still matches.
  • A quiet disappearance. An item leaves the vault, but the paperwork keeps saying it's there.
  • An edited history. The operator's records are the only record — and they can be rewritten.
This isn't hypothetical

It already happens — across every category we protect.

These aren't edge cases — here's what's already happened. Documented public cases across cards, watches, wine, bullion, and art, with real dollar figures. The same gaps that let them happen are exactly what a daily, independent proof is built to close.

Cards

Forged grades on real slabs.

2022–2024: Anthony Curcio and Iosif Bondarchuk cleaned the print off genuine PSA labels, printed fake 9/10 grades and new serial numbers, and sold cards for up to hundreds of thousands each — attempting to defraud victims of more than $2 million. PSA itself estimates roughly $200M in counterfeit cards circulating.

✓ How Truveil catches it: the cert number matched on the fake — but the card's own optical surface fingerprint wouldn't, so the swap is flagged at redemption.

Source: conviction ↗ PSA $200M report ↗
Watches

Superfakes and spoofed NFC "verification."

Counterfeit "Super Clone" Rolexes have grown into a ~£1.5B market. Fraudsters fit a real movement inside a fake case, and weaponize NFC cards that link to spoofed pages showing your watch's serial number as "verified."

✓ How Truveil catches it: any attached tag, NFC chip, or serial lookup can be faked — Truveil fingerprints the watch itself (dial + movement micro-features + serial), which can't be transplanted.

Source: WWD ↗
Wine

The $30M counterfeit-wine lab.

2004–2012: Rudy Kurniawan blended cheap wine into old bottles with forged labels and sold roughly $30M (estimates up to $150M) of fakes; he got 10 years in prison, and as many as 10,000 of his bottles may still sit in private collections. He was caught only because he consigned a vintage that never existed.

✓ How Truveil catches it: a continuous label + fill-level fingerprint plus a tamper-proof provenance chain — a relabeled or refilled bottle breaks the match.

Source: FBI ↗ DOJ ↗
Bullion

Tungsten-core gold bars.

Because tungsten's density (19.25 g/cm³) nearly matches gold's (19.3), fake bars pass a weight check. A Manhattan dealer found ~$100k in tungsten-filled bars after drilling into them, and China's Kingold pledged fake gold bars as collateral for $2.8B in loans.

✓ How Truveil catches it: an acoustic ring test + assay — a tungsten core rings and resonates differently from solid gold, so weight alone no longer fools it.

Source: NBC News ↗ Kingold ↗
Art

$80M in forgeries through a 165-year-old gallery.

1994–2008: the Knoedler gallery sold ~40 forged "Rothkos, Pollocks and Motherwells" for roughly $60–80M before closing in 2011 — expert eyes and paper provenance didn't stop it.

✓ How Truveil catches it: an optical surface + multispectral fingerprint bound to a tamper-proof provenance record — a swapped canvas or invented provenance breaks verification.

Source: CBS 60 Minutes ↗ ARTnews ↗
How we solve it

So we replace the promise with proof.

Every item gets an independent referee. In three plain steps, "trust us" becomes something anyone can check for themselves — every single day.

How Truveil solves it — in 3 plain steps
  1. 1
    We take a unique fingerprint of each item. A close-up of its surface plus the sound it makes when tapped — like a fingerprint no two items share.
  2. 2
    We watch it with a tamper-proof record. Every time the item is touched, it's written to a log no one can secretly rewrite (like a blockchain), and software watches for anything odd.
  3. 3
    Anyone can check it themselves. Every day we publish an independent, signed "still here" proof that no one — not even us — can fake or rewrite afterward.
Under the hood Patent pending

The technology behind the proof.

Three things make a Truveil proof hard to fake: cryptography you can check yourself, a learning layer that can flag but never overrule the math, and a filed patent on the protocol that ties it all together. Here's what each actually is — and here it is, moving.

One day's proof, end to end: fingerprint → tamper-proof chain → an ML flag for humans → signed & publicly anchored.

The independent referee

We handle the software, not the vault.

Truveil provides only the proof layer — the software that verifies. We never take custody of your items. We are not a vault, a marketplace, or a token issuer.

The vault keeps physical custody; Truveil independently checks it. That independence is the whole point — no conflict of interest, unlike an operator auditing itself.

Cryptography

Math, not trust.

You don't have to believe us — the proof is a chain of math anyone can re-check. Rewriting the past breaks it visibly.

  • Tamper-proof custody log. An append-only SHA-256 hash chain where each entry commits to the one before it — rewrite any past record and every later hash visibly breaks.
  • Daily Merkle proof. All item records compress into one Merkle root each day; a collector verifies their specific item is included with a short inclusion proof (~17 hashes for 100k items) without seeing anyone else's inventory (domain-separated tree).
  • Independent signature. Truveil signs the daily root with an Ed25519 key anyone can verify with the public key. The signing keys never touch the vault operator — so the operator cannot forge, backdate, or alter a proof.
  • Public anchor. Each day's signed root is committed to a public record (RFC 3161 timestamp authority or a public blockchain). After anchoring, no one — not even Truveil — can rewrite history.

● Live All of this runs in the browser demo — real SHA-256 via Web Crypto. Open the demo →

Machine learning

A second set of eyes.

A model watches the event stream for anything odd — but it can only raise a hand for a human. It can't get around the cryptography.

  • Flags, never freezes. An anomaly model watches for off-hours access, telemetry gaps, and unusual cycle-counts and raises a soft flag for human review — a hard freeze only comes from a cryptographic mismatch. Human-in-the-loop by design.
  • Model provenance. Every model is content-hashed and folded into the signed daily attestation, so a swapped or poisoned model is detectable.
  • Anti-gaming. An exploration floor in the sampling policy means an adversary can't drive their risk score down to avoid being inspected.
  • Calibrated, not magic. Thresholds are measured decision boundaries learned from data — not hand-picked numbers.

See the ML layer explained →

The patent

Patent pending.

A provisional is filed — it establishes a priority date on the novel layer: the continuous attestation protocol, not optical fingerprinting itself.

  • What's covered. The continuous-attestation protocol. Provisional title: "System and Method for Continuous Cryptographic Attestation of Physical-Asset Custody with Lifecycle-Bound Biometric Object Verification Gating Digital Token State."
  • Claimed elements. Lifecycle-bound fingerprint verification that gates a token's state (match → release/burn; mismatch → freeze); hash-chained custody evidence; challenge-nonce liveness sampling (an unpredictable time-bound code the vault must photograph in-frame — defeating old-photo replay — rendered on e-ink); public anchoring; a mutual-countersigning witness network (competing vaults countersign each other's daily heads, so faking history requires corrupting several companies at once); ML model-provenance folded into the signed attestation.
  • Downstream applications. Insurer premium adjustment, lender LTV / margin / default triggers, and legal evidence chain-of-custody.
  • Honest prior art. Optical fingerprinting itself is prior art (Alitheon, 55+ patents — Truveil licenses it behind a vendor-neutral interface); fingerprint + ledger binding alone has prior art (aXedras). Our claims target the continuous-attestation layer that gates token state and chains custody over time.

Claims are as-filed and subject to examination. Not legal advice.

Built for insurers & audits

Live proof-of-backing, not a once-a-year snapshot.

Truveil's continuous, independent, cryptographically-signed proof gives underwriters live proof-of-backing to price and monitor risk on — instead of a single annual snapshot — and gives auditors independent, tamper-evident evidence they can rely on. It supports insurance underwriting and audit processes; it doesn't replace them.

See the difference move

A vault backed by a promise — then backed by proof.

On the left, the three quiet ways "it's in the vault" fails. A daily pulse carries each item to the right, where Truveil fingerprints it, writes it to a record no one can rewrite, and signs a "still here" proof — freezing the token the instant something doesn't match.

Daily
independent "still here" proof — not once a year
2
separate fingerprints per item (look + sound)
1‑day
window to catch a swap (vs. up to a year)
0
ability for the vault to fake our proofs
Every check, in plain language Patent pending

What Truveil actually checks.

A forger would have to beat all of these at once, on the same day, in public. Each card below is one plain-English check — what it does, a real example, and a simple picture of how it works.

The old ways vs. daily proof

Why nothing else catches it.

Truveil Self-attestation Annual attestation Cert-number lookup
Detects a swapped card? ✓ ✕ ✕ ✕
Detects a missing card? ✓ ✕ ~ ✕
Tamper-proof history? ✓ ✕ ✕ ✕
Independent of the operator? ✓ ✕ ~ ~
Continuous, not point-in-time? ✓ ✕ ✕ ✕
Verify it yourself? ✓ ✕ ✕ ~

"The cert number matched on both slabs. Ours didn't."

Watch it work, step by step

How Truveil works.

How Truveil works — five simple steps, in plain language. Each shows what you do and what Truveil does. Press play, or step through it yourself.

    Want the real cryptography behind step 5? Open the live fraud-catch demo →

    The same flow, as one picture

    The whole system at a glance.

    One item's journey, end to end — two fingerprints (look + sound), a tamper-proof log watched by AI, a daily signed proof locked to a public record, and a final match-or-freeze check. Beat one signal and the others still catch you.

    Two orthogonal physics signals + a signed daily record + a learning layer that can flag but never overrule the math. A forger must beat all of it, on the same day, in public.

    Secure automation · not hype

    The machine-learning layer, explained.

    A learning layer rides on top of the protocol. It watches the event stream and sharpens every match — but it can flag, never freeze. Signing authority and thresholds stay with the independent attestor, and every model is content-hashed into the signed attestation.

    Watches the event stream

    A model reads the custody stream for off-hours access, telemetry gaps, and anomalous cycle-counts. Deviations raise an item's risk without waiting for a human to notice.

    Produces a soft flag

    ML output is a soft flag for human review — never a hard freeze. Only hard cryptographic mismatches HALT automatically; the learning layer can raise a hand, not pull the trigger.

    Content-hashed into the attestation

    Each model's version and hash is committed to the evidence chain and named in every daily attestation — so a swapped or poisoned model is itself detectable.

    Exploration floor

    Risk-weighted sampling aims the challenge-nonce pop-quiz at the highest-risk items first — with an exploration floor so risk-scores can't be gamed and every item is still eventually checked.

    Secure by design

    The learning layer can't overrule the math

    ML runs on the capture side, but signing authority and thresholds stay with the independent attestor — key separation intact. Every model's version and hash is committed to the evidence chain and named in each daily attestation, so a swapped or poisoned model is itself detectable. Hard cryptographic mismatches HALT automatically; soft ML-risk flags are human-reviewed. And challenge-nonce liveness defeats ML spoofing and replay.

    Play with the physics

    How each feature works.

    Three live explainers you can poke at. A forger has to beat two independent physics channels at once — watch why that is hard. (Interactive models running in your browser; algorithms validated in software — capture hardware is productizing.)

    Optical fingerprint

    Same item, any angle or light.

    Card being re-photographed
    Match confidence97%
    SAME ITEM ✓

    The descriptor is rotation-, scale-, and lighting-invariant — re-photograph the same surface under any conditions and it still matches. Move the sliders.

    Acoustic resonance

    The sound the slab makes.

    Resonance match—

    A sealed slab rings with a modal signature set by its exact mass, welds, and stiffness. Crack-and-reslab destroys that assembly — a fake can look right and still ring wrong. Tap each button (sound on).

    Multimodal fusion

    Beat one channel? Still caught.

    MATCH ✓
    optical 90% · acoustic 90%
    Fused verdictboth high

    Fusion is fail-closed: MATCH only if both channels clear. Spoof one and the other trips the wire → MISMATCH. An attacker must defeat two orthogonal physics signals at the same time. Drag the dials.

    Live in your browser · nothing faked

    The vault, and the referee watching it.

    Five real marquee items sit in the vault below. Every hash, Merkle root, signature check, and tamper detection here is computed live by the real Web Crypto API.

    Collection value under continuous attestation
    $34,081,000
    Real items, real public-sale figures. Est. values are illustrations, not appraisals. Slab art is a placeholder for the licensed photo — the item's surface is the ID, not its artwork.
    VAULT · 5 ITEMS Select a card, then act
    🔒 These hashes are computed live in your browser — view source.
    The challenge-nonce pop-quiz is ML risk-weighted — it targets the highest-risk items first.
    TRUVEIL REFEREE CONSOLE
    What's real here — and what's local, by design

    Real: every SHA-256 fingerprint, Merkle root, inclusion proof, and tamper check on this page is computed live by your browser's Web Crypto API — view source. Local by design: the Ed25519 signature is made with a demo key generated in your browser, because the production attestor key lives in AWS KMS and never leaves it. Only the attestor can sign. If this page could mint a real attestation from your laptop, that would be the vulnerability — key separation is the product.

    APPEND-ONLY CUSTODY EVIDENCE integrity: OK
    Each row commits to the hash of the one before it. Edit a past event and watch every later link break.
    One platform, seven products Patent pending

    What Truveil protects.

    Cards ship today. The rest are modeled in our system — same checks, different items. Each card shows one real example. Press Genuine or Swapped/Fake to hear the difference: a real item rings true; a swap rings wrong. (Sound on.)

    Item names and headline figures are real-world references; est. values are illustrations, not appraisals. Every serial, bottle, bar, and canvas identifier shown is a demo-only fabricated string. Illustrations are original, generated art — the item itself is the ID, not the picture.

    Simple, volume-friendly pricing Patent pending

    Pricing.

    You pay a small fee to fingerprint each item once, then a flat monthly fee for the daily proofs. No hardware to buy. The first vaults get a free pilot.

    Per item

    Fingerprint an item

    $0.50–$2/ item

    A one-time fee when an item is first checked in and fingerprinted. Volume-tiered — the more items, the lower the price.

    • Look + sound fingerprint captured
    • Locked to the item's digital token
    • No tags, stickers, or chips
    Most vaults

    Daily proof subscription

    $3k–$15k/ month

    A flat monthly fee per vault for the daily independent "still here" proof, the tamper-proof log, and the AI watch.

    • Signed proof published every day
    • Public anchor no one can rewrite
    • Instant freeze alert on any mismatch
    • Anyone can verify their own item
    Request a pilot
    Insurers & lenders

    Underwriting reports

    $25k+/ year

    Signed proof-of-backing feeds for insurers and lenders who need to know the collateral is really there — every day.

    • Daily proof-of-backing feed
    • Loans that react automatically
    • Court-ready chain-of-custody exports
    Design-partner offer

    Free 90-day pilot for the first card vaults, in exchange for a public case study. We'll wire up a live daily proof feed for your vault.

    Request a pilot

    Figures are indicative starting points, not a quote. Final pricing depends on volume and integration scope.

    About Truveil

    Built by someone who did this for the government first.

    Truveil takes the discipline of federal continuous monitoring — continuously proving that controls still hold, instead of checking once a year — and brings it to physical custody of collectibles. Here's who's behind it, and why.

    Vivek Sindhu

    Founder & CEO · UnifiedSec Technologies, Inc.
    Delaware C-corp · Truveil is a UnifiedSec product
    vivek.sindhu@unifiedsectech.com

    Vivek spent about a decade in federal continuous-monitoring and cybersecurity engineering — the discipline of continuously attesting that security controls still hold, rather than signing off once and hoping. That work spanned programs like DHS/CISA's Continuous Diagnostics & Mitigation (CDM) and standards including FISMA and NIST 800-53.

    That is exactly what Truveil commercializes for physical custody: don't trust an annual snapshot — prove, every day, that each item is still there and unchanged.

    He pairs that with something rarer: native fluency in the collector market — trading cards, watches, and TCGs — because he's a collector himself. Few people hold both the federal continuous-attestation background and real collector-market fluency. That overlap is why Truveil is built the way it is.

    Why I built Truveil

    Billions of dollars of tokenized cards and collectibles are backed only by an operator's word plus one annual snapshot. I kept looking at that gap and seeing the same problem I'd spent a decade solving for federal systems.

    The continuous-attestation methods I built for government could give collectors and vaults something they've never had: independent, daily, cryptographic proof that the item is really there — not a promise, and not a once-a-year check.

    So I built Truveil to be the neutral referee. We are only the software and proof layer. We never take custody of anyone's items — no vault, no marketplace, no token issuance. That independence isn't a footnote; it's the entire point.

    UnifiedSec Technologies, Inc.

    Truveil is a product of UnifiedSec Technologies, Inc., a Delaware C-corp. If you run a vault or hold tokenized collectibles, let's talk about a pilot.

    Request a pilot / email Contact form
    Turn "trust us" into math

    Request a pilot.

    Free 90-day design-partner pilot for the first card vaults — in exchange for a public case study. Tell us about your vault and we'll wire up a live attestation feed.

    Request a pilot
    Submitting opens your email client to vivek.sindhu@unifiedsectech.com — no data leaves your browser.