WIND-DOWN PROTOCOL
The Wind-Down Protocol
A permanent record can't depend on one company surviving forever. So here is exactly what happens to your record if Atonr does not.
Last updated 21 June 2026
01 Why this exists
A permanent record can't rest on one company surviving forever. Companies don't. So the promise isn't "Atonr will always be here" — it's "your record will, whether or not Atonr is." This protocol is how.
It is written carefully because it is a core trust promise. If we ever can't keep the lights on, this is what we are bound to do first.
02 The chain of preservation
Every paid record carries two proofs that don't depend on us: a timestamp signed by an independent authority, and a Proof Code you can verify on your own device. A public record gets a third — a snapshot in the Internet Archive.
If Atonr's servers went dark today, those two proofs would still hold: your record's date and your Proof Code don't depend on us. The words themselves outlive us through the final export below — published in the open for anyone to keep.
03 Why it needs no heir
We could name a successor company to inherit the archive. We won't promise what we haven't signed — and a paper promise isn't what keeps a record alive.
Instead, on wind-down we publish one last complete export of the paid archive — every record's text, date, Proof Code, and the public index — as a single open file anyone can download, keep, and mirror. Nothing to apply for, no custodian to trust: the per-record proofs already stand on their own (above), and the final export lets the whole set outlive us in any hands that choose to keep it.
04 What you would be told
If wind-down ever begins, every record-holder is emailed: what is happening, where your record is going, and how to keep your own copy. Nothing disappears quietly.
Free records, which were never preserved, are not part of the handoff — their tombstones already say so. Paid records are.