Everything that happens on your cards, chained and hashed.
The blooChain is the activity log of bloo.Cards. Every exchange, every card change, every invoice and every payment becomes a link sealed by a cryptographic fingerprint. Nobody, not even us, can then alter, remove or insert a link without the verification revealing it.
SHA-256 · HMAC · RFC 3161 timestamp · Verified every day
What the blooChain records
Interactions
Messages and forms, quote requests, appointments, bookings, reviews, card exchanges, connection requests, Wheel entries and prizes handed out.
Card changes
Content, modules, layout, theme, fonts, images, translations, status of the card and of each module: every change of look or content leaves its trace.
Billing and payments
Subscriptions, plan changes, options, invoices and payment notifications from our provider Mollie, with the payment reference.
Account and security
Sign-ins and refused attempts, two-factor authentication, users and roles, API keys, exports and deletions.
Simply viewing a card is not chained: views are counted in your statistics, with no IP address in the clear.
How a link is sealed
1. Everything is hashed
The event (who, what, which card, when) and the SHA-256 fingerprint of its content are combined in a canonical form, then hashed with SHA-256. The content itself never enters the chain: only its fingerprint does.
2. Each link holds the previous one
Each link's fingerprint contains the fingerprint of the previous link and a gap-free sequence number. Changing a single character of the past, removing a link or slipping in a new one breaks everything that follows.
3. Each link is signed
An HMAC-SHA256 signature, computed with a secret key kept outside the database, accompanies each link. A copy of the database is not enough to forge a valid link.
Anchored outside, every day
Full verification every day
Every day, the whole chain is re-read from its first link: fingerprints, signatures, order, and the presence of the seals of previous days. The slightest break triggers an immediate alert.
Timestamped by an independent authority
The day's seal (the fingerprint of the last link) is timestamped under the RFC 3161 standard by a timestamping authority outside bloo.Cards. The signed token it returns proves the chain existed exactly as it was on that date.
Seal sent by e-mail
The day's seal, its sequence number and the verification result leave our servers by e-mail every day: one more trace, kept elsewhere.
Immutable copy Coming soon
Each seal will also be stored on write-once storage (WORM), on an account separate from our servers: once written, it can be neither modified nor deleted for the whole retention period.
What it proves
That a message was received on a given date, that a card showed given content at a given time, that a payment was notified, that a change was made by a given user: the blooChain guarantees the truthfulness of exchanges. And because each day's seal is timestamped outside, rewriting the past, even entirely, would contradict the seals already issued.
Tamper-proof, and respectful of privacy
Content stays out of the chain
What your visitors write is never copied into the chain: only its fingerprint goes in. Personal data can therefore be erased at your request without breaking the chain.
Pseudonymised IP addresses
The IP address is turned into a secret-key fingerprint before entering a link: it never appears there in the clear.
Your log belongs to you
The export of your data includes your log. With Premium and Corporate, the back-office History shows the changes to your cards, by card and by user, with CSV and Excel export.
Frequently asked questions
Is the blooChain a blockchain?
It takes its essential principle, links held together by their fingerprints, without cryptocurrency, without tokens, without a public ledger and without the energy use of a public blockchain. Its anchoring comes from an independent timestamp and from copies outside our servers.
What does “hashed” mean?
Hashing means computing the fingerprint of a content (here with SHA-256): a string of 64 characters that changes completely if a single character of the content changes, and from which the content cannot be recovered. That is what makes any alteration visible.
Can bloo.Cards modify the log?
Not without it showing. An alteration breaks the fingerprints and signatures, and a complete rewrite would contradict the seals already timestamped by the outside authority and sent by e-mail.
Are views of my card in the chain?
No. Views are counted in your statistics. The chain records actions: interactions, changes, billing, payments, sign-ins and settings.
Is it GDPR compliant?
Yes. The content of exchanges stays out of the chain (only its fingerprint goes in), IP addresses are pseudonymised, and personal data can be erased without breaking the chain.
Exchanges whose truthfulness can be proven.
The blooChain is active on every card, whatever the plan. For the rest of our measures, see Security & privacy.
Your free card