ISSUE · YOUR EXIT

Leaving costs one DNS record, and every credential you ever issued keeps working.

We would rather earn the renewal than hold the hostage. This page is on the site before you have signed anything, it is linked from the buyer's page, and it is as specific as we can make it — including the parts that are more than one record.

What staying costs Back to the overview

One thing to hold on to: nothing you hand out points at us. Every credential you issue names your domain, so a verifier checking it years from now resolves your name and never learns that we existed. That is what makes leaving a move rather than a migration.

Why leaving is cheap — the actual mechanism

A credential carries the name of whoever signed it. On this platform that name is a domain you already own, resolved at a well-known path under it. The verifier fetches that path to get your keys. Where the file is actually hosted is your business, and it can change on a Tuesday without telling anybody.

So the exit is not an export, a migration or a data transfer. It is a change of address for three small static files. Point the record somewhere else and the entire installed base of credentials keeps checking out, because nothing in them ever referred to us in the first place.

GET https://id.orbis.id/.well-known/did.json — 200, 669 bytes, checked 2026-08-27

This is the whole of it. Read it and notice what is not in it: no reference to a vendor, no platform identifier, no endpoint of ours. Two public keys under your name.

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/jws-2020/v1"
  ],
  "id": "did:web:orbis.id",
  "verificationMethod": [
    {
      "id": "did:web:orbis.id#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "MupKZa26RgQMQasnNxv4eDIS7XzIpGfDA4a9Y4TJvYY", "y": "oo_fTfpVOyJSpQmS9VaMuby4WCi55pzDhd0BklllVYc" }
    },
    {
      "id": "did:web:orbis.id#key-2",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "53l5yME2Ut_Fx_S3wpCfN2lVCPaWOXheNxH4GZpj8Is", "y": "YIQijcuvassCjvvio3d7EuiRcGHYdMbZtFjf2huszck" }
    }
  ],
  "assertionMethod": ["did:web:orbis.id#key-1", "did:web:orbis.id#key-2"]
}

The record is the move. These three files are the obligation.

Here is the part most exit clauses leave out, so we will put it in the middle of the page instead. Changing the record is one action. Keeping your credentials verifying afterwards means keeping three documents answering — and they are all static files whose measured sizes are below.

Your key document

/.well-known/did.json · 669 bytes, measured 2026-08-27

Answers "is this signature real?". Without it every credential you ever issued fails the first check.
```
curl -s https://id.orbis.id/.well-known/did.json | jq .
```
Your issuer metadata

/.well-known/jwt-vc-issuer · 408 bytes, measured 2026-08-27

The same two public keys, at the path an SD-JWT VC verifier looks in first. Almost nobody mentions this one.
```
curl -s https://id.orbis.id/.well-known/jwt-vc-issuer | jq '.jwks.keys | length'
```
Your status list

/status/1 · 452 bytes, measured 2026-08-27

Answers "has it been withdrawn?". A careful verifier refuses a proof it cannot check this against.
```
curl -s -D- -o /dev/null https://id.orbis.id/status/1 | grep -i content-type
```

Under two kilobytes of static files, all told. That is the entire technical dependency a departing issuer inherits, and it is the reason we can afford to be relaxed about the exit: there is no lock-in to give up, because there was never any to build.

What you would be moving to

Any static host. The three documents are files, served over HTTPS, at fixed paths under a domain you control. No database, no runtime, no us. A signing capability is the one live piece you would need to replace, and only for credentials you issue after the move — everything already in the world keeps verifying on the keys in the file above.

The one thing we would ask you to keep, and cannot enforce, is the key. Remove a public key from that document and every credential it signed stops verifying, immediately and permanently. That is a real deletion. It should be a deliberate one.

Why we publish this before the sale

Departure costs one DNS record. We think that is the only honest way to sell infrastructure to a state: make leaving cheap, and then earn the renewal every year.

The same sentence is why this website publishes everything we have not built. A vendor who has made leaving expensive has to keep you; a vendor who has made leaving trivial has to keep being worth it. We would rather be the second kind, and the way to prove which kind you are is to publish the exit before anyone has signed anything.

Prove the exit before you need it

You do not have to take the mechanism on trust, and you do not have to be a customer to test it. These commands resolve a live issuer the way a verifier would — which is the same thing you would run against your own domain the day after moving.

The keys, from the domain and nowhere else

curl -s https://id.orbis.id/.well-known/did.json | jq .

The same keys, at the path an SD-JWT VC verifier reads

curl -s https://id.orbis.id/.well-known/jwt-vc-issuer | jq '.jwks.keys | length'

And what the issuer says it issues

curl -s https://id.orbis.id/.well-known/openid-credential-issuer | jq .

All three answered on 2026-08-27. Run them against any did:web issuer on earth and they behave the same way, which is the point — the exit is a property of the standard, not a favour from us.

What is real about this exit today.

The mechanism is real and you have just been handed the commands that prove it. What has not happened is somebody actually leaving — no issuer has exercised this path, so it is a design that holds rather than a drill that has been run.

The register holds 17 live · 2 partial · 2 planned · 5 not yet.

3 of the 3 capabilities this page depends on have no row in the register yet, so this page will not print a state for them. They are named rather than dropped, because a slice that silently shortens itself is the same defect as a claim with no receipt.

did-web-anchor
hosted-verification
data-export

The register route serves, but it carries no row for these yet. List what it does carry:

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Two things this page is not claiming. There is no written exit SLA, because there is no SLA today at all and we will not blur alerting into one. And no issuer has yet moved off this platform, so what you are reading is the measured behaviour of the documents rather than a case study of a departure.

What would make this page stronger is a customer who left and said it was easy. We do not have one, and we would rather say so than imply one.

Straight answers

Do I get my data back?: There is nothing of yours here to give back. The facts stayed in your systems; we minted and revoked signed statements about them and never asked for a copy of your member table. What you take with you is the key material and the three documents above.
Do credentials I already issued keep working?: Yes, provided the public keys stay published under your domain. Verification reads your name, resolves your document, and checks the signature against the key that made it. Nothing in that sequence involves us, before or after you leave.
What about the private key — can I take that?: No, and that is the honest cost of never having to handle it. Signing happens inside a cloud vault and the private half never leaves it, which is what makes the custody claim true and also means the key cannot be exported. You rotate: publish a new key beside the old one, sign new credentials with the new one, and leave the old one listed so everything it signed keeps verifying.
Can you cut me off?: We can stop issuing new credentials for you. We cannot stop existing ones verifying, because that check does not run here — it runs against a document under your domain. The distinction is the whole design, and it is the answer to the question behind the question.
Is any of this contractual?: Not yet. The terms are here.

Do not trust us. Check us.