// DEVICE BINDING

device_id = get_hsm_device_id();

public_key = device_get_public_key();

nonce = generate_nonce();

challenge = sha256(nonce || device_id || tx_hash);

signature = device_sign(challenge);

verify_signature(public_key, signature, challenge);

// TRANSACTION BINDING

tx_hash = sha256(transaction_payload);

policy_hash = sha256(authorization_policy);

approval_token = encrypt(

tx_hash,

policy_hash,

timestamp,

device_id

);

store_audit_log(approval_token);

// POLICY BINDING

policy = get_authorization_policy();

if (policy.allows(transaction, device, context))

grant_approval();

else

deny_approval(t);

// CANONICAL INTENT MESSAGE

intent = canonicalize({ subject, amount, recipient, policy_id, nonce, exp });

h = sha256(intent);

σ = ed25519.sign(sk_tee, h);

receipt = jws({ intent, σ, kid, alg: 'EdDSA' });

ledger.append(sha256(receipt));

// DEVICE BINDING

device_id = get_hsm_device_id();

public_key = device_get_public_key();

nonce = generate_nonce();

challenge = sha256(nonce || device_id || tx_hash);

signature = device_sign(challenge);

verify_signature(public_key, signature, challenge);

// TRANSACTION BINDING

tx_hash = sha256(transaction_payload);

policy_hash = sha256(authorization_policy);

approval_token = encrypt(

tx_hash,

policy_hash,

timestamp,

device_id

);

store_audit_log(approval_token);

// POLICY BINDING

policy = get_authorization_policy();

if (policy.allows(transaction, device, context))

grant_approval();

else

deny_approval(t);

// CANONICAL INTENT MESSAGE

intent = canonicalize({ subject, amount, recipient, policy_id, nonce, exp });

h = sha256(intent);

σ = ed25519.sign(sk_tee, h);

receipt = jws({ intent, σ, kid, alg: 'EdDSA' });

ledger.append(sha256(receipt));

// DEVICE BINDING

device_id = get_hsm_device_id();

public_key = device_get_public_key();

nonce = generate_nonce();

challenge = sha256(nonce || device_id || tx_hash);

signature = device_sign(challenge);

verify_signature(public_key, signature, challenge);

// TRANSACTION BINDING

tx_hash = sha256(transaction_payload);

policy_hash = sha256(authorization_policy);

approval_token = encrypt(

tx_hash,

policy_hash,

timestamp,

device_id

);

store_audit_log(approval_token);

// POLICY BINDING

policy = get_authorization_policy();

if (policy.allows(transaction, device, context))

grant_approval();

else

deny_approval(t);

// CANONICAL INTENT MESSAGE

intent = canonicalize({ subject, amount, recipient, policy_id, nonce, exp });

h = sha256(intent);

σ = ed25519.sign(sk_tee, h);

receipt = jws({ intent, σ, kid, alg: 'EdDSA' });

ledger.append(sha256(receipt));

// DEVICE BINDING

device_id = get_hsm_device_id();

public_key = device_get_public_key();

nonce = generate_nonce();

challenge = sha256(nonce || device_id || tx_hash);

signature = device_sign(challenge);

verify_signature(public_key, signature, challenge);

// TRANSACTION BINDING

tx_hash = sha256(transaction_payload);

policy_hash = sha256(authorization_policy);

approval_token = encrypt(

tx_hash,

policy_hash,

timestamp,

device_id

);

store_audit_log(approval_token);

// POLICY BINDING

policy = get_authorization_policy();

if (policy.allows(transaction, device, context))

grant_approval();

else

deny_approval(t);

// CANONICAL INTENT MESSAGE

intent = canonicalize({ subject, amount, recipient, policy_id, nonce, exp });

h = sha256(intent);

σ = ed25519.sign(sk_tee, h);

receipt = jws({ intent, σ, kid, alg: 'EdDSA' });

ledger.append(sha256(receipt));

10101010 00110101 11001011

01010111 10011010 00101101

11001100 01100110 10101011

10110010 01011101 00111100

01110011 10101010 11010001

ENCRYPTION STATUS

▮▮ ACTIVE

KEY EXCHANGE

▮▮ ECDSA P-256

▮▮ AES-256-GCM

8B330133 0x8F A4 3C 9B 7E 2D 1F 6A 5C 13 90 EE 44 7B 2A 3D

8E200320 0x8F A4 3C 9B 7E 2D 1F 6A 5C 13 90 EE 44 7B 2A 3D

8E380083 0xC8 14 7E 2A 91 4D 6F 03 BA 27 5C 81 EE 19 4F D2

8E380091 0x12 90 4F BB 6C 21 8D 5A 70 14 6E 39 A8 22 D4 0E

8E3800A4 0x55 7C 89 D1 4B 30 6F 19 28 BC 4A 71 5E 02 9D 6F

8E3800B7 0xA1 0E 33 7B 5C 8D 91 24 6F 0E 7B 13 49 8C 5D 22

8E3800CA 0xF4 22 5B 0E 71 3C 9D 18 6A 4F 88 31 BC 27 6E 1D

8E3800DD 0x09 6F 38 1A 5C 7E 4B 21 8D 33 7A 19 6E B4 25 90

8E3800F0 0x6E 91 4F 28 7B 12 5C 33 8D 49 6A B1 17 24 5E 8F

8E380103 0x3A 7F 91 BC 01 2E 6D 33 88 45 7C 2A 09 EF 55 10

8E380116 0x6E 44 2F 7A 8B 31 16 5C 9D 02 D1 8C 3E 5F 72 0A

8E380129 0x9B 4D 67 C1 17 6E 2A 53 7F 88 14 33 6D 5C 92 0E

8B330133 0x8F A4 3C 9B 7E 2D 1F 6A 5C 13 90 EE 44 7B 2A 3D

8E200320 0x8F A4 3C 9B 7E 2D 1F 6A 5C 13 90 EE 44 7B 2A 3D

8E380083 0xC8 14 7E 2A 91 4D 6F 03 BA 27 5C 81 EE 19 4F D2

8E380091 0x12 90 4F BB 6C 21 8D 5A 70 14 6E 39 A8 22 D4 0E

8E3800A4 0x55 7C 89 D1 4B 30 6F 19 28 BC 4A 71 5E 02 9D 6F

8E3800B7 0xA1 0E 33 7B 5C 8D 91 24 6F 0E 7B 13 49 8C 5D 22

8E3800CA 0xF4 22 5B 0E 71 3C 9D 18 6A 4F 88 31 BC 27 6E 1D

8E3800DD 0x09 6F 38 1A 5C 7E 4B 21 8D 33 7A 19 6E B4 25 90

8E3800F0 0x6E 91 4F 28 7B 12 5C 33 8D 49 6A B1 17 24 5E 8F

8E380103 0x3A 7F 91 BC 01 2E 6D 33 88 45 7C 2A 09 EF 55 10

8E380116 0x6E 44 2F 7A 8B 31 16 5C 9D 02 D1 8C 3E 5F 72 0A

8E380129 0x9B 4D 67 C1 17 6E 2A 53 7F 88 14 33 6D 5C 92 0E

SESSION STATUS

SECURE

BOUND

VERIFIED

AUDIT LOG

ACTIVE

THREAT LEVEL

MINIMAL

INTEGRITY

VERIFIED

TIME SYNC

12:45:32 UTC

Cryptographic Approval Platform

Authorization,
not authentication.

TrueSign replaces one-time passwords with hardware-bound cryptographic approvals, bound to the device, bound to the transaction, bound to the policy.

Request institutional briefing For investors

Patent Filing

USPTO: 19/644,477
Docket: DWTP101US-TJC
Priority: Sept 30, 2025
Filed: Apr 10, 2026
Inventor: Charles Cohen
Assignee: Data World 1, LLC
Claims: 14 (Method · System · Platform)

The signing act, in three movements

Intent. Hardware-bound signature. Cryptographic receipt.

Each authorization produces a deterministic, hardware-attested artifact. The receipt is independently verifiable and committed to a hash-chained ledger.

01, The problem

OTP proves who clicked. It does not prove what was authorized.

One-time passwords and traditional second-factor authentication confirm presence on a session. They do not bind a code to a recipient, an amount, a counterparty, a policy condition, or a coercion signal.

Failure mode

Phishing

OTP codes are reusable secrets transmitted out-of-band. A convincingly crafted page captures the code and replays it within the validity window.

Failure mode

SIM-swap

Telecom-account takeover redirects SMS OTP to attacker-controlled SIMs. The carrier becomes the weakest link in the bank’s authentication chain.

Failure mode

Authorized push payment fraud

OTP confirms a session, never a recipient or amount. Coerced or socially engineered users authorize the wrong transaction; OTP records prove only that they did.

02, The approach

Authorization, signed by hardware. Bound to the action.

A canonical intent message describes the exact action under approval. The user’s device signs it inside a Trusted Execution Environment with a non-exportable private key. The platform verifies, applies policy, and issues a cryptographic receipt.

Authorization Request

Enterprise backend submits action parameters to the TrueSign API Gateway.

Canonical Intent Message

Platform constructs a deterministic encoding: subject, amount, context, policy_id, expiry, nonce.

Cryptographic Signing

Client device displays the human-readable action; the secure execution environment signs the canonical message with the non-exportable private key.

Verification & Policy

Platform verifies signature against the registered public key, then evaluates policy: thresholds, roles, risk, geofencing, time-locks.

Decision & Receipt

Allow / deny returned with a cryptographic receipt (JWS or COSE). Every decision is written to the immutable audit ledger.

{
 "intent_id": "ti_01HZK4G7…",
 "subject": "user:9f1c…4e",
 "device": "att:tee:5b3a…",
 "amount": { "value": "2,500,000.00", "ccy": "EUR" },
 "recipient": "acct:DE89:…:7841",
 "policy_id": "wire.tier3.dual_control",
 "context": { "channel": "swift", "geo": "DE" },
 "nonce": "8f3c…b201",
 "issued_at": "2026-05-11T09:14:22Z",
 "expires_at": "2026-05-11T09:16:22Z"
}

Read the platform overview →

03, Industries

Built for regulated authorization workflows.

Banking

Wire, treasury, and admin authorization across Tier-1 institutions.

Learn more →

Government & Federal

NIST AAL3 by protocol design; FedRAMP Moderate implementation in progress.

Learn more →

Defense

Hardware-bound mission-critical action approval; post-quantum-ready.

Learn more →

Insurance

Non-repudiable claims approval with adjuster cryptographic binding.

Learn more →

Fintech

PSD2 / PSD3 SCA that ships in days, not quarters. SDK-grade.

Learn more →

04, Credibility

Patent

USPTO 19/644,477

Cryptographic Intent-Bound Authentication System for Action Authorization. 14 claims; three independent (Method, System, Authorization Platform). Sole inventor: Charles Cohen.

Patent & IP position →

Regulatory alignment

By design, not configuration.

, PSD2 / PSD3 SCA
, FFIEC
, NIST SP 800-63B AAL3
, NIST SP 800-207
, FedRAMP Moderate
, CMMC 2.0
, MAS TRM
, RBI Master Direction
, APRA CPS 234

Compliance & regulatory →

Founder

Charles Cohen

Sole inventor, USPTO 19/644,477. Thirty years of sovereign-scale infrastructure and fintech execution. Former CCO Strategy & Development at SkyPower Global; founder & CEO TransCash.

About the founder →

“OTP proves who clicked. It does not prove what was authorized. That gap is not a bug in OTP. It is OTP’s definition. TrueSign closes the gap by signing the action itself.”

, Charles Cohen, founder & inventor

Institutional engagement

Request institutional briefing.

NDA-gated technical deep-dive available within five business days. Briefings are conducted by Charles Cohen with security architecture, compliance, and procurement leadership.

Direct: charlesc@dataworldone.com
Phone: +1 310-753-2558
Office: 8383 Wilshire Blvd, Suite 323, Beverly Hills, CA 90210

Authorization,not authentication.

Intent. Hardware-bound signature. Cryptographic receipt.

OTP proves who clicked. It does not prove what was authorized.

Phishing

SIM-swap

Authorized push payment fraud

Authorization, signed by hardware. Bound to the action.

Authorization Request

Canonical Intent Message

Cryptographic Signing

Verification & Policy

Decision & Receipt

Built for regulated authorization workflows.

Banking

Government & Federal

Defense

Insurance

Fintech

USPTO 19/644,477

By design, not configuration.

Charles Cohen

Request institutional briefing.

Institutional briefing request

Authorization,
not authentication.