The sovereignty contract

0. What we mean by “your record”

Your record is everything a student captures over time and chooses to seal — courses, work samples, jobs, reflections, and the transcripts they get issued from all of it. Each piece is sealed with SHA-256 and gets a short id that anyone can verify without an Eformogi account.

• tr_ — a transcript you issued. A printable, verifiable summary a receiver can open with no login.
• cr_ — a single course on a transcript. A teacher can cosign it; the cosignature is its own receipt.
• ws_ — a work sample: something you made, read, won, worked at, got better at, learned from, or showed up for.
• att_ — an attestation. A signature from a teacher, coach, counselor, mentor, supervisor, employer, peer, or family member, naming what they witnessed.
• wn_ — a weekly note (the Sunday Note). Reflection in your own voice. Never transcript evidence; never countersigned.
• wl_ — a curated wall. A handful of things you pinned for a specific person to see.
• tl_ — a private timeline entry. Captured on your device; not published unless you publish it.

When the clauses below say “your record,” they mean all of the above — together and in any combination. Adding a new kind of receipt does not shrink any clause; the contract binds Eformogi to every prefix it has ever issued.

1. Students own. The record is free forever.

The record belongs to the student. The vault, the receipts, the transcripts, the cosignatures, the exports, the revocation tools — all of it — are free to students and families in perpetuity, by contract. There is no premium tier that holds your own record hostage, and no paid plan that gates the basics. Optional, family-elected paperwork services — done-for-you compliance documents generated from the record you already own — may be paid; declining them never locks, degrades, or deletes the record. Capture, witnessing, issuance, export, and verification stay free.

This clause survives acquisition, change of control, and bankruptcy. The only permitted off-ramp is one (1) year of written notice plus full export in an open, machine-readable format at no cost to the student or family. If we ever cannot honor this, we shut the records office down on those terms. We do not sell the off-ramp. We do not sell the family.

An optional family legacy / multi-generational tier may exist in the future, but it is capped at no more than 10% of revenue and is never load-bearing for the business.

2. Sovereignty by default.

No piece of your record leaves the device, no receipt is issued, no agent gets a token, and no receiver gets a verification check without an explicit act by you or someone you have named. Defaults are off. Sharing is opt-in, per share. Revocation is one tap and propagates to every copy that checked.

The audit log is yours. End-to-end encryption — where not even Eformogi can read inside your record — is on our roadmap (see our Security posture); today your record is held under strict, you-scoped access controls. Eformogi cannot share on your behalf. Eformogi cannot grant any third party — including any AI agent, any school, any college, any employer, any government agency — a standing authorization to your record. Standing authorizations do not exist in this product, by design.

3. Receivers pay the toll — and only for what they get.

Every dollar of revenue comes from the receiver side — the institutions that need to act on a student’s record. There are six of them named on our receiver page:

• Colleges and conservatories — Common App readers, RISD / Juilliard / Berklee admissions, registrar transfer-credit offices.
• Scholarships and foundations — Davidson Fellows, Jack Kent Cooke, QuestBridge, Gates, Rhodes / Marshall / Truman.
• Employers and apprenticeships — pre-employment background, building-trades unions, DOL Registered Apprenticeship sponsors.
• Next schools — K-12 transfer registrars at the receiving school. A donor-paid SKU exists for high-mobility families (McKinney-Vento, Title-I, refugee resettlement) whose next school cannot absorb the cost.
• Licensing and clearance — state licensing boards (CPA, bar, nursing) and federal security-clearance investigators (OPM / DCSA).
• Insurance and visa — life and disability underwriters; F-1 / J-1 / H-1B / student-visa caseworkers; refugee resettlement.

Single-link verification is free, always. A receiver who opens one verify link pays nothing. The toll begins when a receiver wants to verify at scale, through an API, with an audit trail in their own system, or through a custom integration with their admissions / HR / underwriting platform.

We do not run RFPs against school districts. We do not sell to K-12 schools as issuers of records. We do not sell to camps, clinics, or sports leagues as platform customers. We do not sell to banks, tenant screeners, or consumer-genealogy products. The refusal list is permanent and published.

4. Witnesses verify for free, forever.

The people who add their signature to a student’s work — teachers, coaches, counselors, mentors, supervisors, employers, peers, family members — are not customers and are never charged. Cosigning a course (cr_) or a work sample (ws_) is free, requires no Eformogi account, and produces a receipt (att_) the signer can verify on their own.

Witnesses are the channel that gives this product its meaning. We will not, by contract, ever convert them into a billing line. Counselors and teachers who carry the product to their students do so at no cost to themselves or their schools.

What this means in practice

• Your record — courses, work samples, jobs, reflections, walls, transcripts — is free, in perpetuity, for students and families.
• Witnessing a student’s work is free, in perpetuity, for teachers, coaches, counselors, mentors, supervisors, employers, peers, and family signers.
• If we get acquired, the new owner inherits all four clauses. There is no version of this product that charges students or witnesses for their part of the record.
• If we shut down, you get one year of notice and a full export in an open format. Your record does not vanish.
• The receiver pays for verification at scale. Not the student. Not the family. Not the witness.

Why this is in the open

Personal-data products tend to start with promises and end with renegotiated terms-of-service the morning after an acquisition. We are publishing these four clauses as a contract, on the open web, before we are large enough to be tempted to break them. If you ever read a future version of this page that softens any of the four, you should leave the product and take your record with you. The export will work. That is the point.