How we protect the journal

What the book is

Texas requires a record of notarial acts (Gov’t Code § 406.014). As of 1 September 2025 that record must be kept 10 years from the act date. Final lines are hash-chained. We do not rewrite a historical hash.

What we do not collect

We do not store driver license or ID numbers, fingerprints, or biometrics. The journal records the type and description of identification, as Texas instructs. xNotary Ledger is not a RON room and does not keep the audio-video recording of a remote sitting. That tape, when required, is held separately.

Who can see a sitting

• The commissioned notary who took the act. Records remain in that notary’s exclusive control. There is no live sharing of sittings with a firm owner or other notaries.
• Firm owners see fees and lock state so they can run the practice. They do not receive signatures, ID descriptions, or full addresses.
• xNotary Ledger operators (team@xnotaryledger.com) for product operations — not as a substitute notary.
• If a firm connects its own practice software: a lock notice with fees and line summaries so that firm can invoice. That system does not receive signatures, ID descriptions, or full addresses. An outside accountant does not see the journal.
• Entries are public information under Texas law. Anyone may request a certified copy and pay the fee. That is not live access to the book.

How records are stored

Live records sit in a dedicated database used only for xNotary Ledger. They are not mixed with any notary practice’s books, vault, or tax packet. xNotary Ledger, LLC corporate records, when stored, use a separate vault database from this journal. Secret cells (signature image, street, ZIP, ID description, notes, credible-witness address) are encrypted at rest with AES-256-GCM. Signer name stays searchable so certified-copy intake still works.

How records are backed up

Live records sit in the xNotary Ledger production database only. Secret cells (signature image, street, ZIP, ID description, notes, credible-witness address) are encrypted at rest (AES-256-GCM). Signer name stays searchable so certified-copy intake works.

Nightly encrypted backups are written to the application host and to two independent US cloud providers:

• the application host (Spaceship), same environment as the live database
• Amazon S3 (US East, Ohio), bucket used only for this product, Object Lock Compliance mode, default retention 10 years, MFA on root, backup principal limited to put/get of dump objects
• Google Cloud Storage (us-central1), bucket used only for this product, ten-year retention, Standard then Nearline / Coldline / Archive by age. Backup principal limited to put/get of dump objects

We do not keep production journal dumps on personal laptops or personal consumer cloud drives. There is no standing live read of secret cells. If an incident requires an operator to decrypt a secret cell, the operator must first record a ticket (operator id, time, ticket id, notary id, fields touched) in the operator console. On written request or contract end, we deliver the notary’s export and remove live working copies except legally required locked backups.

Draft vs locked

A draft is editable and is not an official book line. It is not hash-chained and cannot be produced as a certified copy. A locked line is the official record: immutable fields, hash-chained, eligible for certified copy. Voided drafts are kept as a void record; a locked line cannot be voided. Mistakes on a locked line take an append-only correction note.

Certified copies

Texas treats journal entries as public information. After fees are paid, the notary must provide a certified copy of requested entries or a written explanation within ten business days. The fee is $1.00 per page (Gov’t Code § 406.024(a)(8)); the notary may waive it. The commissioned notary certifies the copy. The company does not. Public requesters use /records-request— that form does not show journal contents.

Leaving a firm

The book stays with the commissioned notary. If a notary leaves a firm, the firm keeps billing and seats, not the record book. The firm cannot retain, export, or lock the departing notary’s lines.

Questions

team@xnotaryledger.com. Confirm current SOS rules before relying on this summary.