You make a good product. You have a GSTIN, an IEC, a chamber-issued Certificate of Origin, and a track record of shipments that were actually paid for. None of that helps you at the moment it matters most: when a buyer's procurement team, or their bank's trade desk, opens an email from an Indian supplier they have never dealt with and has to decide whether you are real.
Everything you send them is a PDF. A Certificate of Origin PDF can be edited in a few minutes. A company letterhead proves nothing. An I've-been-exporting-for-ten-years claim is just a claim. So trust gets built the slow, expensive way — references, sample orders, advance payments held back, letters of credit with belt-and-braces terms — and the first deal is always the hardest. This article is about a different approach: assemble the proof once, into a bundle the other side can verify independently, and put it behind a single link you control.
The problem isn't your documents — it's that they can't be verified at a distance
A genuine Certificate of Origin issued by a chamber of commerce or DGFT is a real, authoritative document. The issue is purely one of distance: by the time it reaches an overseas buyer as an email attachment, there is no cheap way for them to confirm it is the same document the chamber issued, addressed to the same exporter, unaltered. The authority that created it is in India; the person who has to trust it is not. The document is good — the chain of custody from issuer to relying party is broken.
Closing that gap is what AssureLocker's Trade Provenance Pack does. To be clear about the boundary up front: AssureLocker does not issue Certificates of Origin or identities, and does not lend, finance, or take custody of funds. It takes the genuine, issuer-created documents you already hold and makes them foreign-verifiable — tamper-evident and checkable by the counterparty themselves. It is a Technology Service Provider, not an issuer, a bank, or a marketplace.
What a Trade Provenance Pack answers: WHO, WHERE-FROM, REALISED
The pack composes building blocks you already have into one bundle organised around the three questions a cautious counterparty actually asks. It is published at a public address — your provenance page, at /provenance/<packId> — that anyone you share the link with can open. Critically, it contains no PII: only the specific fields a verifier needs to check, plus cryptographic hashes and registry anchors. Nothing is taken wholesale; you choose exactly what goes in.
WHO — your verified business identity
The first thing a stranger needs is confidence that the entity exists and is who it claims to be. The pack carries your DigiKYB identity — registry-backed against sources like GSTIN — alongside a GLEIF Legal Entity Identifier (LEI). The LEI matters enormously for cross-border trade: it is the globally-recognised root of trust for legal entities, the same identifier recognised by banks and customs systems across the UAE, Singapore, the EU and beyond. Your buyer doesn't have to take our word that your LEI is valid — the pack links straight to the public GLEIF registry, where they confirm it independently.
WHERE-FROM — the trade documents, made tamper-evident
This is where your Certificate of Origin lives — and, generically, any other typed trade document: a bill of lading, a GI certificate, an insurance certificate, or an emissions declaration (for example, for EU CBAM reporting on steel or aluminium). Each document is:
- Made tamper-evident — a SHA-256 hash is taken so any later alteration is detectable. Note the word: tamper-evident, not tamper-proof. A relying party can detect that a document was changed; this is a strong, honest guarantee, but it is not a claim that the underlying records can never be compromised by any means.
- Recorded in an immutable registry — only the hash goes into the registry, never the raw document or any PII — so the fingerprint has an independent, timestamped record behind it.
- Rendered as an OpenAttestation / TradeTrust document — the open format the Singapore-led international trade ecosystem already consumes. A foreign customs or bank desk can run it through the standard public TradeTrust / oa-verify tooling and confirm, on their own, that it has not been altered.
The document itself is still issuer-created: the chamber or DGFT for a Certificate of Origin, an accredited verifier for an emissions declaration. AssureLocker makes a genuine one foreign-verifiable — it does not manufacture the document or certify the underlying facts.
REALISED — proof that money actually came back
A claimed trade relationship and a proven one are very different things to a bank. The pack can include e-BRC realised-forex history — your electronic Bank Realisation Certificates — where access is available. An e-BRC is the record that foreign exchange against your exports actually came home through an Authorised Dealer bank. It turns “we've shipped to buyers like you before” into a count of realised transactions and a relationship duration that the counterparty's credit team recognises immediately. Where you don't provide it, the pack simply shows that section as not provided — it is never fabricated.
/provenance/<id> — what your buyer, their bank or a customs desk verifies for themselves. Synthetic demo data.Every claim is graded — so a verifier knows how hard it stands up
Honesty about strength is the whole point. Each component in the pack carries an explicit evidence tier, so a relying party sees not just what you assert but how strongly it is backed:
- Registry-verified — confirmed against an authoritative registry (e.g. GSTIN-backed identity).
- Verifier-attested — attested by an independent accredited verifier.
- Issuer-attested — backed by the document's original issuer.
- Self-declared · tamper-evident — you declared it, but it is hashed and anchored so any change is detectable.
- Self-declared — your statement, presented plainly as such.
Alongside each, the pack gives an independent-verify link: the LEI via the GLEIF public registry, and each document via the official TradeTrust / oa-verify tooling. The grading and the verify links are what let you be confident and the counterparty be sceptical at the same time — a healthy combination.
How your buyer actually verifies it
From the other side, the experience is meant to take minutes, not days, and to require no trust in AssureLocker. Your buyer, their bank, or a customs desk:
- Opens the link you sent — /provenance/<packId> — and sees the WHO / WHERE-FROM / REALISED structure with each section's evidence tier on display.
- Clicks through to the GLEIF public registry to confirm the LEI and its status themselves — that check happens on GLEIF's infrastructure, not ours.
- Opens each OpenAttestation / TradeTrust document and runs it through standard oa-verify tooling to confirm the document hash matches and nothing was altered after issuance.
- Sees the immutable registry anchor and document fingerprints for the tamper-evidence trail.
Because the verification leans on public registries and an open document standard, your counterparty is not being asked to believe a vendor. They are checking sources they already recognise. That is what makes a single shared link a credible substitute for weeks of relationship-building on a first order.
You stay in control of what you share
The pack is consent-gated: you decide exactly which documents and fields go into it, and the public bundle contains no personal data — only the fields a verifier checks, plus hashes and anchors. You assemble it once and reuse the same link across buyers, banks and customs desks, or revoke and regenerate it as your situation changes. Nothing is taken from you wholesale, and nothing about your buyers or pricing is exposed by the act of proving who you are and where your goods come from.
An honest summary
The Trade Provenance Pack will not make a bad shipment good, and it will not get you financed — AssureLocker carries and verifies your evidence; it does not lend, take custody of funds, or decide anyone's credit. What it does is narrow, concrete and genuinely useful: it takes the genuine documents you already have, makes them tamper-evident and independently verifiable across borders, and lets you hand a wary counterparty a single link they can check for themselves in minutes. For a first deal with a buyer who doesn't yet know you, that shift — from “trust me” to “verify me” — is often the whole difference. See Export Trust for how the pack is assembled, and the companion guide on how an overseas buyer verifies your pack to share with your counterparty.