FAQ | H33 - Frequently Asked Questions

Q: Does H33 require Internet access?

No. In an air-gapped configuration H33 is deployed entirely inside your boundary with no outbound connectivity, no DNS resolution, and no reachability to h33.ai. There is no SaaS dependency, no external API call and no callback to us. Your system does not have to trust us at runtime.

Q: We don’t permit external APIs into this environment. Is that a problem?

No — neither do we. H33-API-G does not mean an Internet-accessible H33 endpoint. It is an authority protocol that operates locally, inside the enclave, between your own components. Nothing crosses the boundary because nothing needs to.

Q: Can we get evidence out without exporting the sensitive material?

Often, yes. The classified inputs, computation and decision can remain inside while the enclave produces cryptographic evidence and, ultimately, a compact H33-74 attestation representing the governed event — that approved software executed, that approved authority authorized it, that required policy was followed, and that a particular outcome occurred. Important: cryptography does not make an artifact unclassified. Your organization determines classification and releasability, including whether hashes, metadata, timing, identities or derived proofs may cross the boundary at all. H33 provides the mechanism; the release decision remains yours.

Q: What is H33-74 and why does everything reference it?

H33-74 is the portable evidence primitive: a 74-byte post-quantum attestation. Every stage of the cryptographic lifecycle emits this artifact and every validator consumes it. H33-74 produces the portable proof — other capabilities reference it rather than defining their own.

Q: How can data be processed without ever being decrypted?

FHE computes on encrypted data, so matching and inference run over ciphertext and plaintext is never exposed on H33's servers. When a result must be shared without disclosing the underlying data, ZK proves it without revealing the inputs.

Q: How can I independently verify an H33 result?

Verification is designed to render the independent verdict (not yet available for production receipts). The evidence it checks is the receipt H33-74 produces.

Q: Who governs AI decisions and who monitors controls over time?

Agent-008 governs which decisions execute inside the authority boundary, and HATS records a continuous, receipt-bound attestation stream of control state. Both consume the same H33-74 primitive.

1

General / Overview

10 questions

What is H33?

H33 is a privacy-preserving digital identity platform that uses advanced cryptography to enable secure authentication without exposing personal data. We combine three types of Fully Homomorphic Encryption (FHE), dual zero-knowledge proof systems, biometric verification processed entirely on encrypted data, post-quantum cryptography, and blockchain technology to create the most secure identity solution available. Your biometrics are never decrypted on our servers—computations happen on encrypted data using FHE.

Who is H33 designed for?

H33 is designed for:

Enterprises requiring high-security identity verification
Financial institutions needing KYC/AML compliance with privacy
Healthcare organizations protecting patient identity
Government agencies requiring secure citizen authentication
Web3 projects needing Sybil-resistant identity

What makes H33 different from traditional identity solutions?

Traditional identity systems store and transmit sensitive data, creating honeypots for hackers. H33 is fundamentally different:

FHE-encrypted biometrics: Your biometrics are encrypted on your device and processed using Fully Homomorphic Encryption—our servers compute distance and similarity metrics on encrypted data without ever decrypting it
Zero-knowledge proofs: Verification results are proven to third parties without revealing any underlying data
No raw data exposure: Unlike competitors, we cannot see your biometrics even during processing—only the encrypted ciphertext exists on our servers

Is H33 decentralized?

H33 uses a hybrid architecture. Identity proofs are anchored on the Solana blockchain via Soulbound NFTs for immutability and user control. Cryptographic operations run on H33's hardened compute tier. This gives you the benefits of decentralization (user ownership, censorship resistance) with enterprise-grade performance.

What data does H33 store about me?

H33 stores cryptographic commitments, not raw data. We never store your actual biometrics, government IDs, or personal information. We only store mathematical proofs that verify you possess certain attributes. Even if our systems were breached, attackers would find only meaningless cryptographic values.

How do I get started with H33?

Getting started is simple:

Connect your Solana wallet
Complete one-time biometric enrollment (processed locally)
Receive your Soulbound Identity NFT
Authenticate anywhere H33 is integrated

The entire process takes under 5 minutes.

Can I use H33 without cryptocurrency knowledge?

Yes. While H33 uses blockchain technology, we abstract away the complexity. You don't need to understand cryptocurrency, manage gas fees, or interact with smart contracts directly. Our interface handles everything—you just authenticate like you would with any other system.

What happens if I lose access to my account?

Your biometric IS your recovery key—no seed phrases to lose or steal. If you lose access to your wallet or device:

Biometric recovery: Your unique biometric signature lets you re-authenticate and regain access from any device
Account migration: Use your biometrics to shut down compromised accounts and transfer your identity to a new wallet
No seed phrase vulnerability: Unlike traditional crypto wallets, there's no 12/24 word phrase that can be stolen, phished, or forgotten

Your biometric digital fingerprint is the master key to your identity. Only you have it, and it can't be written down or stolen.

Is H33 available worldwide?

H33 is available globally with some restrictions based on local regulations. Our privacy-preserving approach is designed to comply with GDPR, CCPA, and other privacy regulations. Certain features may have regional availability based on compliance requirements.

How can I contact H33 support?

You can reach our support team via:

Email: support@h33.io
Discord: discord.gg/h33
Enterprise customers: Dedicated Slack channel and 24/7 support line

For security issues, use our encrypted contact: security@h33.io (PGP key available on our website).

2

Security Architecture

10 questions

What is H33's security rating?

H33 maintains a 9.9/10 security rating based on comprehensive automated and manual security assessments. This includes 16 formal mathematical proofs, 201+ automated tests, zero critical/high vulnerabilities, and a 8-layer defense-in-depth architecture. See our Testing Methodology for full details.

What is defense-in-depth and how does H33 implement it?

Defense-in-depth means multiple independent security layers. H33 implements 8 layers:

Layer 1: Network perimeter (TLS 1.3, mTLS)
Layer 2: Authentication (Solana wallet signatures)
Layer 3: Authorization (RBAC, smart contract ACL)
Layer 4: Application security (input validation, rate limiting)
Layer 5: Cryptographic layer (FHE, ZKP, PQC)
Layer 6: Hardened execution tier
Layer 7: Data protection (encryption at rest, key rotation)

What is formal verification and why does it matter?

Formal verification uses mathematical proofs to guarantee code correctness for ALL possible inputs, not just test cases. H33 uses the Kani model checker to formally verify 16 critical properties including memory safety, cryptographic bounds, and security invariants. This provides stronger guarantees than traditional testing alone.

Has H33 been audited?

H33 undergoes continuous automated security auditing via cargo-audit, cargo-deny, and Trivy scanning. We maintain zero critical/high vulnerabilities. Third-party cryptologist review of our FHE and ZKP implementations is planned. Our security reports are published transparently.

What happens if H33's servers are compromised?

Even in a total server compromise, attackers cannot steal your identity because:

We don't store raw biometrics—only cryptographic commitments
Private keys are held encrypted and released only to authorized operations
Zero-knowledge proofs reveal nothing about underlying data
Identity ownership is on-chain and cannot be transferred without your wallet signature

What is a Trusted Execution Environment (TEE)?

A TEE is a secure area of the CPU that runs code in isolation from the operating system. H33's Nitro Enclave capability is provisioned on dedicated custody hosts. H33 does not currently represent that a specific production request path executes inside an enclave. Where an enclave is used, code running inside it is isolated from the host operating system and its identity is attested by PCR measurement.

How does H33 handle key management?

Cryptographic keys are:

Generated under H33 key management
Held under access control and rotated on a scheduled basis
Never exposed to the operating system or application code
Rotated automatically on a scheduled basis
Backed up using secure multi-party computation

What security testing tools does H33 use?

Our security pipeline includes:

Kani: Formal verification / model checking
cargo-audit: CVE database scanning
cargo-deny: License and policy compliance
cargo-geiger: Unsafe code tracking
Trivy: Container vulnerability scanning
Hadolint: Dockerfile security linting

How do I report a security vulnerability?

We operate a coordinated disclosure policy. Please report vulnerabilities to security@h33.io using our PGP key (available on our website). We acknowledge all valid reports within 24 hours and work with researchers to fix issues before public disclosure. We do not pursue legal action against good-faith security researchers.

What is the 0.1 gap to a 10/10 score?

We believe in transparency. The 0.1 deduction represents:

Pending third-party cryptologist review of FHE/ZKP implementations
Planned external penetration testing
HSM integration for production key management (in progress)
3 accepted low-risk advisories (unmaintained dependencies with documented mitigations)

3

Fully Homomorphic Encryption (FHE)

10 questions

What is Fully Homomorphic Encryption?

Fully Homomorphic Encryption (FHE) is considered the "holy grail" of cryptography. It allows computation on encrypted data WITHOUT ever decrypting it. The encrypted result, when decrypted, matches what you'd get from computing on the original plaintext. This means sensitive data like biometrics can be processed while remaining encrypted the entire time—even the server performing the computation never sees the raw data.

Why is FHE considered a breakthrough technology?

FHE solves the fundamental tradeoff between privacy and functionality. Traditional encryption requires decryption before processing, creating a vulnerability window. FHE eliminates this entirely:

Data remains encrypted during storage, transit, AND computation
Zero exposure to cloud providers, hackers, or insider threats
Mathematical guarantee that raw data is never reconstructable by the processor
Enables outsourced computation without trusting the compute provider

This represents decades of cryptographic research—first theorized in 1978, only became practical around 2009-2020.

What FHE schemes does H33 implement?

H33 implements three complementary FHE schemes, each optimized for different use cases:

BFV (Brakerski-Fan-Vercauteren): Exact integer arithmetic, efficient polynomial operations. Used for biometric template matching and distance calculations.
CKKS (Cheon-Kim-Kim-Song): Approximate arithmetic on real numbers, SIMD batching. Used for ML inference and similarity scoring.
TFHE (Torus FHE): Fast bootstrapping, boolean circuits. Used for threshold comparisons and binary decisions.

This multi-scheme approach lets us select the optimal FHE variant for each operation.

How does H33 use FHE for biometric processing?

H33's biometric pipeline uses FHE at every stage:

Encrypted Enrollment: Biometric templates are encrypted locally using FHE before transmission
Encrypted Storage: Templates remain encrypted at rest—even database administrators cannot view them
Encrypted Comparison: Distance calculations (Euclidean, cosine similarity) happen on encrypted vectors using BFV
Encrypted Thresholding: Match/no-match decisions use TFHE boolean circuits on encrypted distances
Encrypted Result: Only the final pass/fail bit is decrypted

Your actual biometric data is NEVER decrypted on our servers—ever.

What is the BFV scheme and why does H33 use it?

BFV (Brakerski-Fan-Vercauteren) is an FHE scheme based on the Ring Learning With Errors (RLWE) problem. H33 uses BFV because:

Exact arithmetic: Unlike CKKS, BFV computes exact integer results—critical for security-sensitive comparisons
Polynomial efficiency: Native NTT (Number Theoretic Transform) operations align with biometric vector math
Noise management: Proven noise budget bounds verified via Kani formal proofs
Batching support: SIMD-style operations for processing multiple biometric features simultaneously

Our BFV implementation includes formally verified bounds ensuring computations never overflow.

What is the CKKS scheme and how does H33 use it?

CKKS (Cheon-Kim-Kim-Song) enables approximate arithmetic on encrypted real numbers. H33 uses CKKS for:

ML inference: Running neural network layers on encrypted biometric features
Similarity scoring: Computing continuous similarity percentages
Feature extraction: Processing raw biometric data into template vectors
Batch operations: Encoding multiple values in single ciphertexts for efficiency

CKKS is ideal when slight approximation is acceptable (e.g., 99.9999% vs 100% similarity).

What is TFHE and why does H33 use it?

TFHE (Torus Fully Homomorphic Encryption) excels at boolean operations with programmable bootstrapping. H33 uses TFHE for:

Binary decisions: Encrypted less-than comparisons for threshold checks
Fast bootstrapping: Refreshing ciphertext noise without full re-encryption
Logic circuits: Combining multiple encrypted conditions (AND, OR, NOT)
Final verdict: The encrypted match/no-match decision before result decryption

TFHE's speed makes it perfect for the final threshold comparison stage.

How does FHE compare to zero-knowledge proofs?

FHE and ZKPs are complementary technologies solving different problems:

FHE Purpose: Compute on encrypted data | ZKP Purpose: Prove statements without revealing data
FHE Data Access: Processor cannot see data | ZKP Data Access: Verifier cannot see data
FHE Output: Encrypted computation result | ZKP Output: True/false proof validity
FHE Use Case: "Process my data privately" | ZKP Use Case: "Verify my claim without my data"

H33 uses both: FHE for encrypted biometric processing, ZKPs for proving the result to third parties. Together they provide end-to-end privacy.

What are the performance characteristics of H33's FHE?

H33's FHE is heavily optimized with AVX2 acceleration. February 2, 2026 benchmarks on c7i.48xlarge:

NTT 4096 (standard): 386.9µs roundtrip
NTT 16384 (production): 1.85ms roundtrip
NTT 32768 (high security): 3.98ms roundtrip
CKKS encode_real: 45.2µs (512 slots)
CKKS encode_complex: 52.8µs (512 slots)
Polynomial multiplication (16K): 1.92ms with AVX2

NTT parameter caching achieves 99.2% hit rate. For comparison, competitors like Zama take ~15ms for similar operations—we're 8x faster.

Is H33's FHE implementation formally verified?

Yes. Our FHE implementation includes formal verification via the Kani model checker:

verify_polynomial_bounds: Proves coefficient values never overflow during operations
verify_ntt_inverse: Proves NTT transforms are perfectly invertible
verify_noise_budget: Proves noise growth stays within decryption bounds
verify_ciphertext_validity: Proves encrypted outputs are always valid

These proofs provide mathematical guarantees that our FHE operations are correct for ALL possible inputs—not just tested cases. Combined with 147+ unit tests, this makes our FHE implementation one of the most rigorously verified in production use.

4

Zero-Knowledge Proofs

10 questions

What is a zero-knowledge proof?

A zero-knowledge proof (ZKP) lets you prove something is true without revealing any information about WHY it's true. For example, you can prove you're over 21 without revealing your actual birthdate, or prove you're a verified user without revealing your name. It's like proving you know a password without ever typing it.

How does H33 use zero-knowledge proofs?

H33 uses ZKPs for:

Identity proofs: Prove you own an identity without revealing personal data
Biometric proofs: Prove your biometrics match without exposing the biometrics
Attribute proofs: Prove age, citizenship, credentials without revealing details
Sybil resistance: Prove you're a unique human without linking activities

What ZKP systems does H33 implement?

H33 uses two complementary ZKP systems, both built in-house — not Groth16, PLONK, or any third-party proving system:

H33-ZK-Lookup (128-bit / 256-bit): For identity proofs.
H33-ZK-AIR (128-bit / 256-bit): For biometric proofs.

How fast are H33's zero-knowledge proofs?

H33 offers both its own SNARK-family systems (H33-ZK-Lookup, H33-ZK-AIR) and quantum-resistant H33 STARKs. February 2026 benchmarks:

H33 STARK Identity Prove: 42.6ms
H33 STARK Identity Verify: 5ms
H33 STARK Biometric Prove: 156ms
H33 STARK Biometric Verify: 24.3ms
Cached Proof Verify: 0.057ms (67x speedup)

STARKs are quantum-resistant (based on hash functions, not elliptic curves) and require no trusted setup. Proof caching achieves a 67x speedup for returning users.

Are zero-knowledge proofs mathematically secure?

Yes. We offer our own SNARK-family systems (H33-ZK-Lookup, H33-ZK-AIR — not Groth16 or PLONK) alongside quantum-resistant STARKs:

H33-ZK-Lookup / H33-ZK-AIR: H33's own ZKP constructions, available at 128-bit and 256-bit security
STARKs: Based on hash functions (Blake3/SHA-3), quantum-resistant, no trusted setup required

STARKs are particularly important for post-quantum security—they remain secure even against quantum computers. Our STARK implementation uses Winterfell with 128/192/256-bit security options.

What is a trusted setup and does H33 require one?

A trusted setup generates initial parameters for certain ZKP systems. H33 does not use Groth16 or PLONK, and does not rely on third-party ceremony parameters (such as Zcash Powers of Tau) in production. H33-ZK-Lookup and H33-ZK-AIR are H33's own proof systems.

Can ZKPs be verified on-chain?

By design. Our ZK proofs (H33-ZK-Lookup, H33-ZK-AIR) are designed to be verifiable in Solana smart contracts, so that anyone could check a proof's validity without trusting H33 (not yet available in production).

What is Poseidon hash and why does H33 use it?

Poseidon is a hash function specifically designed for ZKP circuits. Unlike SHA-256 which is expensive in ZKP circuits, Poseidon uses operations (field arithmetic) that are native to ZKP systems, making it 100x more efficient. H33 uses the P128Pow5T3 specification providing 128-bit security with width=3, rate=2.

Can I audit H33's ZKP circuits?

Yes. Our ZKP circuits (H33-ZK-Lookup, H33-ZK-AIR) are open for review. Circuit constraints are formally verified using Kani to ensure they correctly enforce the intended properties. We welcome security researchers to review our implementations.

What happens if ZKP cryptography is broken in the future?

While current ZKP schemes are considered secure, H33 is designed for cryptographic agility. We can upgrade to new proof systems as they become available. Our post-quantum cryptography layer (ML-KEM, ML-DSA) provides additional protection. We actively monitor cryptographic research and participate in standardization efforts.

5

Biometric Authentication

10 questions

What biometrics does H33 support?

H33 supports multiple biometric modalities:

Facial recognition: Using device cameras
Fingerprint: Via device sensors

Multi-modal biometrics can be combined for higher security.

Are my biometrics stored on H33's servers?

No. Your raw biometrics never exist on our servers in decrypted form. Here's what happens:

Biometric capture occurs locally on your device
Features are extracted and encrypted using FHE (Fully Homomorphic Encryption)
Only FHE-encrypted ciphertexts are transmitted and stored
All matching and comparison operations use FHE—computed on encrypted data
Our servers literally cannot decrypt your biometrics—only process them while encrypted

This is fundamentally different from other providers who may encrypt "at rest" but decrypt for processing. We never decrypt.

How does privacy-preserving biometric matching work?

When you authenticate, a multi-layer encrypted pipeline engages:

Your device captures fresh biometrics and encrypts using FHE
The encrypted biometric is sent to our servers (still encrypted)
BFV FHE computes Euclidean distance on encrypted vectors
CKKS FHE calculates similarity scores on encrypted data
TFHE performs the threshold comparison on the encrypted distance
Only the final match/no-match bit is decrypted
A zero-knowledge proof (H33-ZK-AIR) proves the result to third parties

Five FHE schemes work in concert—your actual biometric template is NEVER decrypted during matching.

What is the accuracy of H33's biometric matching?

Our biometric system achieves:

False Acceptance Rate (FAR): < 0.001% (1 in 100,000)
False Rejection Rate (FRR): < 1%

The threshold is configurable—higher security applications can use stricter thresholds. Multi-modal biometrics further improve accuracy.

Can someone steal my biometric template?

No. We store cryptographic commitments, not templates. A commitment is a one-way mathematical transformation—you cannot reconstruct biometrics from it. Even if an attacker obtained the commitment, they couldn't use it to impersonate you or create a fake biometric. Additionally, commitments are salted per-user, preventing rainbow table attacks.

What happens if my biometrics change (injury, aging)?

Biometric systems account for natural variation. Minor changes (aging, minor injuries) are handled by the matching threshold. For significant changes, you can re-enroll with updated biometrics using your existing wallet credentials and multi-factor authentication. We recommend periodic re-enrollment for optimal accuracy.

Is H33's biometric system resistant to spoofing?

Yes. We implement multiple anti-spoofing measures:

Liveness detection: Ensures a real person is present (not a photo/video)
Depth sensing: Where available, detects 3D faces
Challenge-response: Random actions to prove liveness
Behavioral analysis: Detects robotic/scripted movements

How does biometric verification work in the TEE?

For high-security scenarios, biometric comparison is performed on encrypted features under FHE:

Encrypted biometric features enter the enclave
Comparison happens in hardware-isolated memory
Only a pass/fail result exits the enclave
The operating system and other processes cannot observe the comparison

Can I use H33 biometrics without a smartphone?

Yes. H33 supports various capture devices:

Smartphone cameras and fingerprint sensors
Laptop/desktop webcams
Dedicated biometric hardware (USB fingerprint readers, iris scanners)
Kiosk integrations for in-person verification

What regulations govern biometric data and how does H33 comply?

Biometric data is heavily regulated under GDPR (EU), BIPA (Illinois), CCPA (California), and others. H33's privacy-preserving approach exceeds these requirements because we don't store biometric data—only cryptographic commitments. This eliminates most regulatory obligations around biometric storage, deletion, and breach notification since there's nothing sensitive to breach.

6

Post-Quantum Cryptography

10 questions

What is post-quantum cryptography?

Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to resist attacks from quantum computers. Current encryption (RSA, ECC) can be broken by sufficiently powerful quantum computers using Shor's algorithm. PQC algorithms are based on mathematical problems that remain hard even for quantum computers.

Why does H33 need post-quantum cryptography now?

"Harvest now, decrypt later" attacks mean adversaries can record encrypted data today and decrypt it once quantum computers exist. Identity data has long-term value—your biometric template shouldn't be compromised 10 years from now. H33 implements PQC today to protect against both current and future threats.

What post-quantum algorithms does H33 use?

H33 implements NIST-selected PQC standards:

ML-KEM (Kyber-768): Key encapsulation for secure key exchange. 128-bit post-quantum security.
ML-DSA (Dilithium): Digital signatures for authentication. Lattice-based security.

Both are formally standardized by NIST (FIPS 203, FIPS 204).

What is ML-KEM (Kyber)?

ML-KEM (Module Lattice-based Key Encapsulation Mechanism), previously known as Kyber, is a key encapsulation algorithm. It allows two parties to establish a shared secret key over an insecure channel. H33 uses Kyber-768 which provides 128-bit security against both classical and quantum attacks.

What is ML-DSA (Dilithium)?

ML-DSA (Module Lattice-based Digital Signature Algorithm), previously known as Dilithium, is a digital signature scheme. It's used to sign messages in a way that can be verified by anyone but only created by the key holder. H33 uses it for signing authentication tokens and blockchain transactions.

How does H33 implement post-quantum cryptography?

Our implementation includes:

147 unit tests for ML-KEM covering NTT transforms, polynomial operations, and KAT vectors
12 tests for ML-DSA covering key generation, signing, and verification
Hybrid mode combining PQC with classical crypto for defense-in-depth
Hardware acceleration via SIMD (AVX2/NEON) for performance

Are post-quantum algorithms slower than classical ones?

PQC operations are generally comparable to classical algorithms. ML-KEM key generation and encapsulation take microseconds. Signatures are slightly larger than ECC (2-3KB vs 64 bytes) but still practical. H33's optimized implementation with SIMD acceleration achieves near-native performance on modern CPUs.

When will quantum computers break current cryptography?

Estimates vary from 10-30 years for cryptographically-relevant quantum computers. However, the exact timeline is uncertain. NIST, NSA, and security agencies worldwide recommend migrating to PQC now. H33 believes in being prepared—implementing PQC today protects data that needs to remain secure for decades.

Is H33's ZKP system post-quantum secure?

Current ZKP systems (Groth16, PLONK) rely on elliptic curve cryptography which is not post-quantum secure. However, the ZKPs protect privacy, not long-term secrets. Post-quantum ZKPs (lattice-based SNARKs) are being researched, and H33 will adopt them as they mature. Meanwhile, our PQC layer protects key exchange and signatures.

What is hybrid cryptography and does H33 use it?

Hybrid cryptography combines classical and post-quantum algorithms. An attacker would need to break BOTH to compromise security. H33 supports hybrid mode where key exchange uses both X25519 (classical) and Kyber (PQC). This provides protection even if one algorithm is unexpectedly broken while maintaining compatibility.

7

Blockchain Integration

10 questions

Why does H33 use blockchain?

Blockchain provides:

User ownership: You control your identity, not H33
Immutability: Identity records cannot be tampered with
Transparency: Anyone can verify proofs on-chain
Censorship resistance: No single entity can revoke your identity
Interoperability: Works across any application reading the chain

Why Solana specifically?

We chose Solana for:

Speed: 400ms block times enable real-time verification
Cost: Transactions cost fractions of a cent
Throughput: 65,000 TPS supports enterprise scale
Ecosystem: Strong DeFi and NFT ecosystem for integrations
Developer experience: Rust-native matches our backend

What is a Soulbound NFT?

A Soulbound NFT (SBT) is a non-transferable token permanently linked to your wallet. Unlike regular NFTs which can be bought/sold, SBTs represent identity, credentials, or reputation that shouldn't be transferred. Your H33 identity NFT is soulbound—it proves YOU completed verification and cannot be sold to someone else.

What data is stored on-chain?

Only cryptographic commitments and metadata are on-chain:

Identity commitment hash (not actual identity data)
Verification timestamp
Credential attestations (e.g., "verified human", "age > 18")
NFT metadata (image, name)

Personal information, biometrics, and documents are NEVER on-chain.

Do I need SOL to use H33?

For basic authentication, no. H33 can sponsor transaction fees (gasless transactions). For advanced features like minting your Soulbound NFT or on-chain verification, a small amount of SOL is required (typically < $0.01 per transaction). Enterprise customers can have all fees sponsored.

What wallets are supported?

H33 supports all major Solana wallets:

Phantom
Solflare
Backpack
Ledger (hardware wallet)
Any wallet supporting Wallet Standard

We recommend hardware wallets for maximum security.

Can H33 work with other blockchains?

While Solana is our primary chain, H33's architecture is chain-agnostic. The core identity system (ZKPs, biometrics, cryptography) is independent of the blockchain layer. We're exploring Ethereum L2s, Polygon, and other chains based on customer demand. Cross-chain identity bridging is on our roadmap.

What happens if Solana goes down?

H33 is designed for resilience:

Core authentication works off-chain using ZKPs
On-chain verification is optional (for trustless scenarios)
Identity data is backed up outside the blockchain
Temporary Solana outages don't prevent authentication

Your identity persists regardless of network status.

How do smart contracts verify identity?

Smart contracts can verify H33 identity by:

Checking if a wallet holds a valid H33 Soulbound NFT
Verifying zero-knowledge proofs on-chain
Querying credential attestations (age, humanity, etc.)
Using our verification program for Sybil resistance

This enables identity-gated DeFi, governance, and airdrops.

Is blockchain data private?

Blockchain data is public, which is why H33 only stores cryptographic commitments on-chain. These commitments reveal nothing about your actual identity. Someone viewing the blockchain sees only random-looking hashes. The zero-knowledge proofs ensure that verification happens without exposing underlying data.

8

H33 Token

10 questions

What is the H33 token?

The H33 token is the native utility token of the H33 identity ecosystem. It's used for governance, staking, fee payments, and incentivizing network participation. The token aligns incentives between users, validators, and developers building on H33.

What blockchain is the H33 token on?

The H33 token is a Solana SPL token, benefiting from Solana's speed and low transaction costs. The token contract is verified and immutable. Contract address and audit reports are available on our website.

What are the utilities of the H33 token?

H33 token utilities include:

Governance: Vote on protocol upgrades and parameters
Staking: Stake to earn rewards and secure the network
Fee discounts: Pay verification fees with H33 for discounts
Validator incentives: Rewards for running verification nodes
Developer grants: Fund ecosystem development

Do I need H33 tokens to use the platform?

No. H33 tokens are optional. You can use the platform by paying fees in SOL or USDC, or through enterprise contracts with fiat billing. Holding H33 tokens provides benefits (discounts, governance) but is not required for core functionality.

What is the total supply of H33 tokens?

The H33 token has a fixed maximum supply with the following allocation:

Community & Ecosystem: 40%
Team & Advisors: 20% (4-year vesting)
Treasury: 20%
Investors: 15% (vesting schedule)
Liquidity: 5%

Full tokenomics available in our Token page.

How can I earn H33 tokens?

You can earn H33 tokens by:

Completing identity verification (welcome bonus)
Staking existing tokens for rewards
Running a verification node
Referring new users
Participating in governance
Contributing to the ecosystem (bug bounties, development)

How does H33 token staking work?

Staking H33 tokens:

Lock tokens in the staking contract
Earn yield from protocol fees
Gain voting power for governance
Higher tiers unlock premium features
Unstaking has a cooldown period

APY varies based on total staked and protocol revenue.

What is H33 governance?

H33 token holders can participate in governance:

Vote on protocol parameters (fees, thresholds)
Approve treasury spending
Elect council members
Propose and vote on upgrades

Voting power is proportional to staked tokens. Governance is on-chain and transparent.

Where can I buy H33 tokens?

H33 tokens are available on:

Decentralized exchanges (Jupiter, Raydium)
Centralized exchanges (listings announced on official channels)

Always verify the official contract address on our website before trading. Beware of scams using similar names.

Is the H33 token a security?

The H33 token is a utility token designed for use within the H33 ecosystem. It provides access to services (verification, governance) rather than representing investment in a common enterprise. We work with legal counsel to ensure compliance with applicable regulations. Token availability may vary by jurisdiction.

9

Developer Integration

10 questions

How do I integrate H33 into my application?

Integration is straightforward:

Install our SDK (npm, cargo, or REST API)
Get an API key from the developer portal
Add the H33 authentication button/flow
Verify identity proofs on your backend

Basic integration takes under an hour. See our documentation for details.

What SDKs are available?

We provide SDKs for:

JavaScript/TypeScript: authenticated H33 API — nothing to install
React: @h33/react-sdk with hooks and components
Rust: h33-sdk crate
Python: authenticated H33 API — nothing to install
REST API: For any language

All SDKs are open source and available on GitHub.

What can I verify with H33?

H33 supports verifying:

Humanity: Prove the user is a real human (Sybil resistance)
Uniqueness: One account per person
Age: Over 18, over 21, etc. without revealing birthdate
Location: Prove residency without revealing address
Credentials: KYC status, accreditation, memberships
Biometrics: Verify the same person is present

Is there a sandbox/testnet environment?

Yes. We provide:

Devnet: Full functionality on Solana devnet with test tokens
Sandbox API: Mock responses for development
Test identities: Pre-verified test accounts for integration testing

Sandbox usage is free and unlimited for development.

How do I verify ZKPs on my backend?

Backend verification options:

SDK method: h33.verifyProof(proof) - handles everything
REST API: POST /verify with proof payload
On-chain: Call our Solana verification program
Self-hosted: Run verification locally with our libraries

Verification is fast (<10ms) and stateless.

What's the API rate limit?

Rate limits by plan:

Free: 100 verifications/day
Starter: 10,000 verifications/month
Growth: 100,000 verifications/month
Enterprise: Unlimited (dedicated infrastructure)

Rate limit headers are included in all responses.

Can I customize the authentication UI?

Yes. Options include:

Hosted UI: Redirect to H33's branded flow
Embedded: H33 components styled to your brand
Headless: Build your own UI using our SDK methods

Enterprise customers get white-label options with custom domains.

How do webhooks work?

H33 can notify your server of events:

identity.verified - User completed verification
identity.updated - Credentials changed
authentication.success - User authenticated
authentication.failed - Auth attempt failed

Webhooks are signed for security and support retry with exponential backoff.

Is there smart contract integration for Solana programs?

Yes. Our Solana programs enable:

On-chain proof verification
NFT ownership checks
Credential queries
Composable identity gates

We provide Anchor IDL and example integrations. CPI (Cross-Program Invocation) is fully supported.

Where can I get developer support?

Developer resources:

Documentation: docs.h33.ai
Discord: #developers channel with core team
GitHub: Issues and discussions
Office hours: Weekly developer calls
Enterprise: Dedicated integration support

10

Air-Gapped & Classified Deployment

10 questions

Does H33 require Internet access?

No. In an air-gapped configuration H33 is deployed entirely inside your boundary with no outbound connectivity, no DNS resolution, and no reachability to h33.ai. There is no SaaS dependency, no external API call and no callback to us. Your system does not have to trust us at runtime.

Can H33 run inside a classified enclave or a true air gap?

Yes. The full authority stack — H33-Root, Agent-008, H33-BIND, H33-Key, HATS, ZK/AIR/Lookup and H33-74 — deploys inside the boundary as a self-contained system. H33 goes to the enclave; the enclave does not come to H33. See Air-Gapped Deployment.

We don’t permit external APIs into this environment. Is that a problem?

No — neither do we. H33-API-G does not mean an Internet-accessible H33 endpoint. It is an authority protocol that operates locally, inside the enclave, between your own components. Nothing crosses the boundary because nothing needs to.

Who holds the keys in an air-gapped deployment?

You do. Key custody stays in your own hardware, HSM, KMS or enclave. H33 does not receive, escrow or hold your key material. H33 supplies the local authority, governance, proof generation, verification, provenance and evidence machinery — not the secrets.

How do software and policy updates work with no network?

H33 does not phone home to update. We publish a signed release package externally carrying code identity, artifact hash, composition identity, policy version, dependency graph, post-quantum signatures and a BIND record. You move it through your own approved transfer or cross-domain mechanism. Once inside, H33-BIND verifies the exact identity and H33-Root determines whether that artifact is authorized; installation happens only if admission succeeds.

Does the enclave have to trust the transfer medium?

No, and that is the point. Because admission depends on cryptographic identity rather than on how the bytes arrived, the enclave never has to trust the transfer path to establish software authority. That is materially different from “download our latest update.”

Does H33 phone home for licensing or entitlement?

No. An air-gapped deployment does not call out to validate entitlement and does not stop operating without a license check. There is no runtime dependency on H33.

Can we get evidence out without exporting the sensitive material?

Often, yes. The classified inputs, computation and decision can remain inside while the enclave produces cryptographic evidence and, ultimately, a compact H33-74 attestation representing the governed event — that approved software executed, that approved authority authorized it, that required policy was followed, and that a particular outcome occurred. Important: cryptography does not make an artifact unclassified. Your organization determines classification and releasability, including whether hashes, metadata, timing, identities or derived proofs may cross the boundary at all. H33 provides the mechanism; the release decision remains yours.

What about disconnected, intermittent or low-bandwidth (DIL) and tactical edge environments?

That is the third deployment mode: a fully autonomous H33 node with zero external dependency. The three configurations are Connected, Enclave-Installed and Fully Air-Gapped — connected when permitted, autonomous when disconnected, rather than a system that degrades when the link drops.

How does air-gapped deployment relate to Zero Trust?

It is consistent with it. Zero Trust holds that authorization comes from attributes and least privilege rather than from being inside a network. H33 resolves authority locally from governed identity and policy — nothing is trusted because of where it sits on the network, including H33 itself.

11

Compliance & Certifications

10 questions

Is H33 GDPR compliant?

Yes. H33 exceeds GDPR requirements through privacy-by-design:

Data minimization: We store cryptographic commitments, not personal data
Right to erasure: Users can delete their identity anytime
Consent: Explicit consent for all data processing
Data portability: Export your credentials
No profiling: We don't track or profile users

What about CCPA and US privacy laws?

H33 complies with CCPA (California), BIPA (Illinois biometric law), and other US state privacy regulations. Our zero-knowledge approach means we don't "sell" personal information because we don't possess it in usable form. Users have full control and can delete their data.

Does H33 use NIST-approved cryptography?

Yes. Our cryptographic implementations include:

ML-KEM (FIPS 203): NIST post-quantum key encapsulation
ML-DSA (FIPS 204): NIST post-quantum signatures
SHA-3: NIST hash standard
AES-256: NIST symmetric encryption

We follow NIST guidelines for cryptographic implementation.

Is H33 SOC 2 certified?

H33’s H33 has received its SOC 2 Type II report from Prescient Assurance, covering the Security Trust Services category for April 1 – July 1, 2026. (SOC 2 is an attestation/reporting framework, not a certification.) Our infrastructure implements SOC 2 controls:

Security: Encryption, access controls, monitoring
Availability: Redundancy, disaster recovery
Confidentiality: Data classification, encryption at rest
Processing integrity: Input validation, audit logs
Privacy: Consent management, data minimization

Can H33 be used for KYC/AML compliance?

Yes. H33 enables privacy-preserving KYC:

Verify identity without storing PII
Issue attestations (KYC passed, accredited investor, etc.)
Prove compliance to regulators with ZKP audit trails
Integrate with existing KYC providers

Financial institutions can meet regulatory requirements while protecting customer privacy.

How does H33 handle data residency requirements?

H33's architecture supports data residency:

Processing can occur in specific regions
Enterprise deployments support geo-fenced infrastructure
Cryptographic commitments (not data) are stored globally on blockchain
Actual verification happens locally on user devices

We can accommodate EU, US, and other regional requirements.

What audit reports are available?

Available reports:

Security testing methodology and results
Formal verification proof reports
Dependency audit results (cargo-audit)
Penetration testing reports (upon NDA for enterprise)
Third-party cryptographic review (planned)

Contact us for access to detailed reports.

Is H33 HIPAA compliant for healthcare use?

H33 can support HIPAA-covered entities:

Zero-knowledge means no PHI is stored or transmitted
TEE processing provides additional safeguards
BAA (Business Associate Agreement) available for enterprise
Audit logs map to HIPAA accountability control areas

Healthcare implementations require our enterprise plan with BAA.

How does H33 handle legal requests for user data?

Our privacy architecture protects users:

We cannot provide data we don't have (biometrics, personal info)
Cryptographic commitments are meaningless without user cooperation
We publish a transparency report of legal requests
We notify users when legally permitted

We design systems so that even valid legal requests cannot compromise user privacy.

What certifications is H33 pursuing?

Current and planned certifications:

Completed: SOC 2 Type II audit
Planned: ISO 27001
Under review: FIPS 140-3 (for government use cases)
Continuous: Automated security scanning and testing

12

Billing & Pricing

5 questions

How much does H33 cost?

H33 offers flexible pricing:

Free: 100 verifications/day for testing and small projects
Starter ($99/mo): 10,000 verifications/month
Growth ($499/mo): 100,000 verifications/month
Enterprise: Custom pricing with unlimited verifications

All plans include core features. Enterprise adds SLA, dedicated support, and custom integrations.

What payment methods are accepted?

We accept:

Credit/debit cards (Visa, Mastercard, Amex)
ACH bank transfers (US)
Wire transfers (Enterprise)
Crypto (USDC, SOL, H33 tokens with discount)

Invoicing available for annual enterprise contracts.

Is there a free trial?

Yes. All new accounts start with:

14-day free trial of Growth plan features
100 free verifications per day forever (Free tier)
Full access to devnet/sandbox for development

No credit card required to start.

How does enterprise pricing work?

Enterprise plans are customized based on:

Verification volume
Required features (TEE, PQC, custom integrations)
Support level (24/7, dedicated team)
Deployment model (cloud, hybrid, on-premise)

Contact sales@h33.io for a quote.

What's the cancellation policy?

H33 subscriptions:

Monthly plans can be canceled anytime
No long-term commitments required
Annual plans can be canceled with prorated refund
Your data (identity, credentials) remains yours after cancellation

Enterprise contracts have specific terms outlined in agreement.

✓

How H33 Works — Canonical Answers

who owns what

What is H33-74 and why does everything reference it?

H33-74 is the portable evidence primitive: a 74-byte post-quantum attestation. Every stage of the cryptographic lifecycle emits this artifact and every validator consumes it. H33-74 produces the portable proof — other capabilities reference it rather than defining their own.

How can data be processed without ever being decrypted?

FHE computes on encrypted data, so matching and inference run over ciphertext and plaintext is never exposed on H33's servers. When a result must be shared without disclosing the underlying data, ZK proves it without revealing the inputs.

How can I independently verify an H33 result?

Verification is designed to render the independent verdict (not yet available for production receipts). The evidence it checks is the receipt H33-74 produces.

Who governs AI decisions and who monitors controls over time?

Agent-008 governs which decisions execute inside the authority boundary, and HATS records a continuous, receipt-bound attestation stream of control state. Both consume the same H33-74 primitive.

See also — canonical owners: H33-74 produces portable evidence · Verification renders the verdict · FHE computes on encrypted data · ZK proves without revealing · Agent-008 governs · HATS records.