Not a way to manufacture proof
Not proof of earnings, employment, bank balances or ticket ownership. We decline the consumer paystub market outright and refuse "proof of income" use cases.
A document is not the right it describes.
A PDF is not admission. An invoice is not payment. A voucher is not money. So every stub carries a label, and a label needs proof.
Every label, and the proof it requires
No label can be gained by editing the document or setting a field in the browser. If we do not hold the backing proof, the label is not shown. Today only the first seven can appear; the rest are listed so you know what we will and will not claim later.
| Label | Allowed meaning | Required backing proof | Status |
|---|---|---|---|
| Draft | User-edited, not finalized. | The current draft state, saved in your browser. | Live |
| Generated | Rendered from the inputs you provided. | An issuance record, a version number and a SHA-256 content hash. | Live |
| Sample / Keepsake | Illustrative, or a decorative memento. Not valid for admission or as a record. | A visible, non-removable mark; no entry code. | Live |
| Contact card | The optional back of a keepsake: a name and the handles its owner chose. Not a ticket. | Marked CONTACT CARD · NOT A TICKET; its code holds only a swap link or a vCard, which the door rejects. | Live |
| Attended | The door of a stub.cafe event accepted this ticket once. | The organizer console's own check-in record (signed token, first valid scan). Badges for other sellers' events cannot get this label. | Live |
| Invite | The back of an attendance badge: an invite to an organizer's event with the attendee's referral code. Not a ticket. | Marked INVITE · NOT A TICKET; the door rejects it. A referral counts only when the invited guest is checked in at the same organizer's door. | Live |
| Payment self-reported | The issuer says a payment was received or sent. | The issuer's own entry, labelled as self-reported on the document. | Live |
| Issuer verified | A specific issuer attested to the artifact. | A signed issuer API response or verified account authority. | Not yet |
| Transfer authorized | The issuer's rules permit this transfer. | A per-event authorization on record. | Not yet |
| Transferred | The underlying entitlement moved. | An atomic issuer update: new credential issued, old one revoked. | Not yet |
| Payment recorded | A payment system reported a successful charge. | A signed processor webhook, reconciled in our ledger. | Not yet |
| Paid | An invoice settled according to a recorded payment. | A reconciled incoming payment, never the user's formatting. | Not yet |
| Cleared | A bank reported that a check cleared. | A real bank status feed. Never a print event. | Not planned |
What stub.cafe is not
Not a bank or payment processor
We do not hold funds, originate ACH, link bank accounts or clear checks. When payments arrive they run through a licensed processor under its terms.
Not a broad ticket broker
No arbitrary upload-and-sell. Resale, if it opens, is limited to issuer-authorized, revocable, reissuable admissions.
Not a certifier
Polished output is not certification. Words like official, certified, bank-approved, verified and IRS-compliant are not used unless the specific condition is established and documented.
How your data is handled today
- Builders are local. Invoices, vouchers, keepsakes, events, tickets and check-ins are stored in your browser's IndexedDB (
stub_artifacts_v1) and never sent to us. - Forms are explicit. Only the pilot, waitlist, contact and report forms post to our server, to
/api/intake.php, and each says so next to its button. - No cookies, no trackers. No analytics or third-party cookie is set anywhere on the site.
- Rate limits use a truncated hourly hash, not your address.
- Signing secrets stay local. The ticket console's signing key is generated in your browser and does not leave it. Hosted signing arrives with the pilot, with the policies in the privacy policy.
Security controls on the hosted pilot
- Every record scoped to one tenant; deny-by-default authorization checks on read, write, export and share.
- Signed payment webhooks with event deduplication; a browser redirect is never treated as proof of payment.
- Short-lived, authenticated download links; private storage, never on a CDN.
- Admission credentials valid only while the issuer's record says so; a revoked token stays revoked in every copy.
- OWASP ASVS as the engineering verification baseline; outside testing before any payroll, check or resale feature goes live.