Verify employment without handing your people to a data broker.
Tenure lets an employer vouch for its own workforce using its own cryptographic key.
The result is a credential the worker holds and shares directly — the company asking about income gets a signed answer straight from the source.
Today, the middle is where the money is.
A landlord or lender who wants to check someone’s income usually pays a bureau $30–60 for the answer. That bureau may have received the underlying payroll data from the employer for free. The worker is rarely told a check happened and usually does not hold a copy of what was said about them. The whole arrangement rests on one fact: the bureau is the only party that can confirm the income claim.
Tenure’s fix is structural, not a cheaper toll. The service that keeps the records is a commodity, not a chokepoint — when nobody owns the middle, nobody can meter it.
Tenure removes that single point of control.
Where the answer comes from
Signs the statement with its own key.
Holds the credential, chooses what to share.
Checks the signature offline, on their own machine.
How it works
The employer signs.
The employer holds a key and signs each statement about its workforce — that someone is employed, how long they have worked there, and what they earn. The dashboard only composes those statements; a separate, offline Signer app holds the key and approves them. Your root key never runs in a page we serve.
The worker holds it.
The signed credential lands in the worker’s wallet, theirs to keep — along with a receipt that is the worker’s own proof the record existed, even if the employer’s systems are long gone. A second employer means a second, unrelated credential. No thread ties a person’s records together, and no public list they appear on.
The worker shares it, on their terms.
A landlord asking “is this person’s income at least $3,200/month?” does not need the exact salary. The worker picks the granularity — dates only, a band, a threshold, or the exact figure — and the verifier sees only that.
Every share is consented to. Every open and download served through Tenure is logged. Revoking a share stops future access and makes saved copies fail re-verification — it does not delete copies already downloaded.
Why it holds up
01No dependence on us.
A credential checks out against the employer’s signature alone. If Tenure shut down tomorrow, everything already issued would still verify — we drill exactly this: kill the service, delete the mirrors, and the same credential still proves itself against an independent public directory.
02The verification vendor is replaceable.
An employer can drop the service running its credentials and move to another with a signed switch — and nothing already issued breaks. Nobody gets locked in.
03History cannot be quietly rewritten.
Records are chained and witnessed as they are made. An attempt to backdate a hire or erase a stretch of employment after the fact produces evidence anyone can check.
04Plaintext numbers are not kept around.
Once a credential is minted, the underlying plaintext values are purged from the service. There are no readable income numbers sitting in the system to pull back later.
05Your key never touches our servers.
The key is generated on the employer’s own machine, and every signature is made there too. Breaking into our servers would not leak it — it was never here.
06The service can only issue what you allowed.
The registrar mints under a delegation you signed — these claim types, this many per day. Anything outside those caps is invalid everywhere, even though the signature on it is real.
What we promise — and what we do not.
A “verified” result means the employer signed the statement.
It does not mean the statement is true in some larger sense. It is the employer’s word, provably theirs, shown as exactly that.
Two employers’ records are never merged, scored, or cross-checked. Each statement stands alone.
A band or a threshold is a signed smaller fact, not a cryptographic trick that hides the real number — and the product always says which one you are looking at.
We present signed evidence and stop there — no rankings, no recommendations. The party checking decides for itself.
Tenure is an open protocol before it is a company; Tenure Inc. just runs one instance of it.
We would rather state these limits plainly than let you assume something we do not deliver.