News · Learn · November 14, 2026
369 Ledger use cases: what a fingerprint can prove
How a company, a clinic or a public body could prove a record existed without publishing it, what 369 Ledger supports today, and what it never proves.
DRIVE 369 DAO · 5 min read
A ledger of fingerprints lets an organisation prove that a record existed no later than a given time and has not changed since, without putting the record anywhere. The file stays private; anyone with the file (and its salt or key, see below) can check it against the fingerprint. That is what 369 Ledger does, as a testnet-stage pilot that has had no external audit. Below: three ways the pattern is used, what it proves, and what it never does. Facts about the network were read from the explorer on November 14, 2026.
The pattern
- The organisation computes a fingerprint (a hash) of a record, such as a contract, a consent form or a decision.
- The fingerprint, not the record, is written to a ledger that validators sign, whose checkpoints are written to a public chain.
- Later, anyone holding the record recomputes the fingerprint and asks the ledger whether it is there, when it was written, and whether it changed.
Three uses
| Who | Record kept off the chain | What a later check shows | Status on 369 Ledger today |
|---|---|---|---|
| A company | Each version of a contract, a policy, or the log of what an AI agent was allowed to use | This version existed by this time, and the log was not rewritten | Exists, in part. Proof of Origin anchors file fingerprints; vault seals fold a signed AI-use log into one fingerprint, opt-in |
| A clinic | A consent form, a lab report, an access log | The form existed before the procedure; the access log was not edited after the fact | Pattern only. No clinic product; no health-data assessment |
| A public body | A decision, a tender document, a register of rulings | The published decision matches the one first signed, while the file itself stays closed or is published separately | Pattern only. An organisation's own ledger is planned |
The first row is the only one you can try today, and only for the two record kinds the ledger page lists: Proof of Origin needs only a Ghost ID, and a vault seal needs a node we have admitted to the ledger. For the other rows we are describing what the pattern is for, not a service.
Read this before you register a contract. Proof of Origin takes a plain SHA-256 of the whole file into a public log, with no salt and with the title you type. Do not register files that contain personal data, or put personal data in the title, until you have assessed that.
One rule: never fingerprint personal data bare
A fingerprint of a short or guessable record can be found by trying candidates. A fingerprint of a name plus a date of birth, a diagnosis code or a licence plate can be checked by anyone who can guess it. The European Data Protection Board's Guidelines 02/2025 (version 2.0, adopted July 7, 2026) say, in paragraph 52, that a salted or keyed hash of personal data is still personal data and the GDPR still applies, and that unsalted or unkeyed hashes should generally not be considered enough on a public blockchain. 369 Ledger is permissioned for writing, but anyone can read it through the explorer, so we apply the public-chain rule to it. Where personal data must go on a chain at all, paragraph 54 says it is better stored only as a proof of existence (such as a keyed hash), with the data needed to verify it kept outside the chain and highly confidential.
So the working rule is: use a long random salt or a secret key per record, keep it off the chain and confidential, with the record, and treat the record and the key as the thing that needs protecting. If the key or salt is later deleted, the EDPB says the hash should no longer be linkable to the record, provided the hash function holds and the key or salt was never leaked or poorly chosen. It also means nobody can verify that record against the ledger any more. We have not assessed any use against the GDPR or health-data law, and this page is not legal advice.
What it never proves
- Truth. A fingerprint shows the content existed, not that it was correct.
- Authorship. Proof of Origin shows a Ghost ID signed a fingerprint no later than the log accepted it, not who made the file or owns it.
- Independence. All five validators are run by the 369 team today, and the key that writes checkpoints to Base Sepolia is ours. The checkpoints make a rewrite visible, not impossible.
- Lawfulness. A ledger entry says nothing about whether you were allowed to keep or process the record.
- Production readiness. The network is one day old, has had no external audit, and most of the explorer's volume is a test credits service for our own IndoDrive pilot, run from 369 team accounts.
Ask this before you trust any ledger
- Who runs the validators, and can they all be one party?
- Who can write, and who can read?
- What exactly goes on it: a fingerprint, or the record?
- What checks it from outside, and how often?
- What has been audited, by whom, and when?
Our answers are on the ledger page and in what goes on a chain. Where they are weak, the page says so.
Open the explorer · Security and audits · Academy: start here
Questions
- Can a hospital put patient records on 369 Ledger?
- No. Records never go on the chain, only a fingerprint, and today only admitted accounts can write. A ledger of an organisation's own is planned. We have not assessed any health-data rules, so ask your counsel first.
- Is a fingerprint of personal data still personal data?
- Yes, according to the European Data Protection Board: a salted or keyed hash of personal data is still personal data and the GDPR still applies, and unsalted hashes are generally not enough on a public chain.
- What does a fingerprint on a ledger prove?
- That a record with this exact content existed no later than a point in time, and has not changed since. It does not prove the record is true, who wrote it, or that it was lawful to keep.