Pajic

Ocala · Credential integrity

Understand what a credential proves.

Ocala separates signature integrity, issuer identity, signer authority, lifecycle and provenance so applications can explain the evidence behind a credential.

Explore the trust model See capabilities
A credential document with embossed details and a glass proof seal
Concept imagery · product interfaces shown below

A credential has more than one kind of evidence.

Ocala keeps these questions separate. A valid signature does not, on its own, establish who had authority or whether the credential is current.

Signature integrity

Does the canonical payload match the referenced signing key and key epoch?

Issuer identity

Which organization does this credential represent?

Signer authority

Was the signer authorized to issue this credential at the relevant time?

Lifecycle

Is the credential active, suspended, revoked, superseded or expired?

Provenance

Was the information self-provided, source-confirmed, issuer-signed or authority-issued?

Artifact proof

When verifying an artifact, a hash match applies to the exact bytes of the referenced file.

Inspect what verification can tell you.

These examples show why proof and current lifecycle status are separate results.

Signature and current state can be checked.

When the verifier has the required evidence and current lifecycle information, it can report both integrity and the credential’s current state.

Illustrative credential
SignatureMatches payload
IssuerIdentified
AuthorityEvidence present
LifecycleActive

Illustrative product preview

Track changes without rewriting the proof.

  1. Issued

    The canonical payload and proof record what was issued.

  2. Active or suspended

    Lifecycle can indicate a current credential or a temporary suspension.

  3. Revoked or expired

    The state shows explicit invalidation or that the credential has reached its validity limit.

  4. Superseded

    A replacement can be linked to the earlier credential rather than silently replacing the history.

An aircraft preparing for a crew duty

Used behind CrewCloud records.

CrewCloud presents terms such as “Verified by issuer,” “Source confirmed,” “Active,” “Expired,” “Revoked” and “View proof.” Ocala supplies the model behind those distinctions.

For a crew qualification, the source, issuing authority, validity and attached proof each answer a different operational question.

Explore CrewCloud records

Questions about Ocala

Does a valid signature mean the credential is active?

No. Signature integrity and lifecycle state are separate. A signed credential can later be suspended, revoked, superseded or expired.

What can offline verification establish?

It can establish integrity from available proof. Current lifecycle status may be unknown or based on an earlier synchronization.

How does Ocala relate to CrewCloud?

Ocala is the underlying credential integrity and provenance model. CrewCloud presents its results in the language of qualifications and crew records.

Can a modified PDF still match the artifact hash?

A hash match applies to the exact referenced file bytes. A modified file is a different artifact, even if it looks similar.

Get started

Integration questions

Discuss credential provenance and how the model fits your product.

Discuss Ocala

Talk to
Pajic Systems.

Tell us what you need to build, connect or operate.

Contact Systems