Built on the standards, not a private scheme.

Which standards does the platform build on?

• NIST FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) — composite post-quantum signatures on every certificate and attestation; classical RSA/ECDSA face deprecation after 2030 under NIST's draft transition guidance.
• RFC 6962 — Merkle transparency logs: append-only, hash-chained, independently verifiable inclusion proofs for every sealed record.
• IETF RATS (RFC 9334) — the remote-attestation architecture; RankShield operates as the Verifier / trust anchor for results.
• FRCP Rule 11 and court AI standing orders — the certification outputs are designed to support what these obligations ask filers to attest.

What do we store — and refuse to store?

Certificates store digests, verdicts, public citation metadata, and coverage indicators. Privilege attestations store digests and enumerated methods. Neither stores privileged content, filing substance, or client material — the architecture is proof-without-exposure by design. Where a check depends on an external source (live case-law, your firm's citator), that dependency and its coverage are recorded with the result rather than hidden.

The honest edges

• Citation resolution is only as complete as the case-law corpus reachable at verification time; coverage is recorded on every certificate.
• Good-law standing is sourced from your firm's citator — we never independently assert a case is good law.
• Attestations prove architecture and consent, not legal conclusions.
• Quantum-safe describes NIST-standardized post-quantum algorithms, not immunity — no system is 'quantum-proof.'

Frequently asked questions

Why composite post-quantum signatures?

Certificates may need to remain verifiable for decades, so they are signed with both ML-DSA (lattice-based) and SLH-DSA (hash-based) — two different mathematical foundations. If cryptanalysis weakens one family, the other still holds. That redundancy matters most for legal records, whose confidentiality and integrity obligations outlast most technology cycles.

Can I verify a record without a RankShield account?

Yes. Verification uses the receipt itself: check the post-quantum signature, then check the RFC 6962 inclusion proof against the public log head. Both steps use open, documented constructions, which is what makes the verification independent rather than a feature of our dashboard.

Is RankShield Legal a law firm or compliance service?

Neither. RankShield is a security vendor. Its outputs are designed to support compliance obligations — court AI certifications, client audit demands, confidentiality duties — by producing verifiable evidence, but it does not give legal advice and it does not make you compliant by itself. Your professional judgment stays in charge.