Verify your receipts against the public log
Every job on ElephantPool produces a signed receipt, and every hour the receipts are sealed into a public, append-only log. How to check a receipt is really in the record — using nothing we control.
Most inference providers ask you to trust their dashboard. We publish a record you can check — with math, not with our word.
What a receipt is
Every completed job produces a receipt signed by the serving machine's own ed25519 key: model, token counts, timing, and the exact quantization that ran (as the digest of the weights file). The private key never leaves that machine, so a receipt proves which host did the work — we could not forge one if we wanted to.
What the public log adds
A signature proves authorship. It does not prove the receipt is in the record we publish, or that the record was not quietly edited later. So every hour we seal that hour's receipts into a Merkle tree and publish a signed head: epoch number, leaf count, root hash — and the previous hour's root. Chaining is the point: rewriting any past hour breaks every head published after it, and those are already in other people's hands.
# the whole log, one line per hour, append-only
curl https://app.elephantpool.ai/api/gateway/v1/log/heads.jsonl
# the inclusion proof for one of your jobs
curl https://app.elephantpool.ai/api/gateway/v1/log/proof/<job_id>The proof is a handful of sibling hashes. You rebuild your leaf from what you already hold, walk the proof to a root, and compare it to the head you fetched — no data from us is trusted along the way. Quiet hours are sealed too: a gap in a log is indistinguishable from a deletion, so there are none.
The sampling you can audit
A random slice of jobs is answered twice, on different machines, and compared — that is part of
how work is verified. The selection itself is auditable: before each day we publish a
commitment (the hash of a secret), jobs are selected by HMAC of that secret, and
the secret is revealed the next day at /v1/log/beacons. A host cannot predict which
jobs are watched, and we cannot cherry-pick after the fact — the commitment predates the jobs.
What we do not claim
Precision matters more than adjectives. The log proves we have not quietly rewritten history; an external timestamp (so that not even we could rewrite it openly) is the next step on the roadmap, and until it ships we say so rather than rounding up. The verification maths is standard — RFC 6962, the same construction Certificate Transparency uses for the web's certificates.
See also: the model catalogue · download mahout · how the whole system works · the blog