SIGLThe app links a local cryptographic identity to one browser window. It opens a private page after an explicit action, then can control that window with the iPhone trackpad and keyboard.
Secure Identity · Generic Link
Local identity and remote control for web displays.
SIGL selects a browser window, opens a private page using an authorization signed by the iPhone, then remotely controls it. This page provides the information required for review, privacy and support.
Public: domino only
Private: domino + photo
Private: domino + photo
Information for Apple Review
A testable flow with no account, subscription or dedicated hardware required.
Afficher reference.sigl.ai sur un autre écran, toucher la carte Reference dans l’app, puis lire son domino. La page passe de l’état public — domino seul — à l’état privé — domino et photo. Un nouvel appui revient à l’état public.
The camera is used only to read a SIGL domino. The Photos picker provides access only to the selected image. Bluetooth selects the last active SIGL display and is optional for review.
No username, password, subscription, in-app purchase or dedicated hardware is required. The P-256 identity is created on the iPhone and its private key remains in the iOS Keychain.
The menu can disconnect displays and delete the identity and local data. The app also sends a signed deletion request to compatible servers that were used.
The demonstration site, privacy policy and support contact remain publicly available throughout review.
One interface, three entry points
The web remains universal. The phone provides trust.
The web server displays content. The app retains the private key, selects the target and signs every private opening.
Domino
The browser creates a short client identifier. The app reads the domino, resolves the server and authorizes that exact screen.
BLE
The local relay announces the last SIGL client that received focus. The app then performs the same signed authentication as with the domino.
Private navigation
From a private page, a link to another server is validated by the same phone before any new handoff.
A display with no identity of its own
A neutral browser can receive any content, instantly.
A SIGL display needs neither a user account nor a specialized app. It simply runs a browser in one or more windows. Identity, content selection and authorization remain in the personal controller.
Each window has its own domino and becomes an independent target. Public or private content can be replaced without entering information on the display.
The iPhone or Android phone selects the server, signs private access, then provides the pad, keyboard, click, scroll and zoom controls.
The same function can be carried by a small dedicated BLE device: confirmation button, selection of the last active display and a key protected by a secure element. This wearable controller, still to be prototyped, would make SIGL usable without carrying a phone.
The display does not know the person and does not choose the document. It receives only a public URL or a private handoff already authorized by the controller.
Beyond authentication
A first building block for a capability-oriented OS.
In SIGL, an administrator can manually verify supporting evidence or a condition, then issue a signed credential. The phone retains it and the user chooses whether to present it. Another server, specialized in a different service, can then grant access to selected data or features after verifying that credential.
The administrator reviews the submitted evidence and validates the credential from the user table. The credential binds its issuer, holder, type and validity date.
A specialized server can certify a degree, qualification or authorization after reviewing the corresponding documents.
After reviewing evidence, an authorized server can issue an age or adulthood credential that other services can use.
A municipality or specialized service can certify residence, membership or an eligibility scope.
A competent server can attest that a person is unique in a given context, for example to prevent multiple registrations in the same program.
Credential badges on cards select the capabilities added to authentication. No unselected capability is transmitted.
The issuer key does not travel with the credential. The target server resolves it from its directory cache, verifies the signature and applies its own policy.
Each target server simply defines which data and features are accessible for the valid credentials presented. It remains independent from the issuer and does not have to perform every administrative verification itself.
A single application can unlock distinct, cumulative capabilities according to the verified credentials held by the person.
Lifeguard
Report an observation, enter site conditions and contribute to day-to-day bathing-site monitoring.
Bathing-site manager
Manage site information, opening status, facilities and locally implemented measures.
Municipal officer
Monitor municipal sites, coordinate stakeholders and publish or validate information falling under the local authority.
Water-quality verification body
Submit or validate test results with a verifiable source and authority.
The Vigie Baignade server therefore does not ask every stakeholder to recreate a professional identity. It verifies credentials issued by the competent servers and immediately adapts the accessible data and actions.
Current protocol
A short target-bound authorization that cannot be durably replayed.
HTTPS transport currently uses compact JSON objects. The critical part is a canonical binary message signed with P-256/SHA-256.
SIGL1 | screen SID (6) | client nonce (2) | timestamp (8)
| target SID (6) | photo size (4) | photo | private time (8)
signature = ECDSA-P256-SHA256(message)
UID = last 6 bytes of the compressed public key
The app first compares the directory hash. It reloads entries and server public keys only when that hash changes.
The issuer site key is not transported with the credential. The target server retrieves it from its directory cache and verifies every signature.
Remote URLs must use HTTPS. An inconsistent signature, SID, nonce or target causes rejection.
Visible invariant
Public and private must never be ambiguous.
| Public page | Domino only. No identity photo is displayed. |
|---|---|
| Private page | Domino extended with the photo, visual certificate, user number, pseudonym and private timer. |
| Private key | Created on the iPhone, stored in the iOS Keychain and never transmitted. |
| Handoff | Every private server change goes through the phone and produces a new signed authorization. |
| Network | HTTPS/WSS for public services; BLE carries only a screen-selection marker. |
Privacy policy
No advertising, no analytics, no tracking.
Last updated: August 10, 2026.
P-256 private key in the Keychain, cropped identity photo, background image, directory and favicon caches, selected credentials and time counters.
During a private opening, the UID, public key, signature, identity photo, private time and selected credentials are sent only to the chosen server.
The photo visually distinguishes a private page. The SIGL servers in this infrastructure keep it in memory during the session and do not write it as a persistent profile photo.
A server may retain fields and documents that the user explicitly chooses to submit. Each site remains responsible for its purpose and retention period.
The camera reads SIGL dominos only. Bluetooth detects the active SIGL relay only. The Photos picker limits access to selected images.
The app can return every screen to public mode, disconnect all displays and delete the SIGL identity, local data and associated deletion requests.
No data is sold or used to track the user across apps or websites.
Apps
The same protocol on iOS and Android.
The iPhone version is being prepared for TestFlight. Its public link will be enabled here without changing this page’s official address.
Distribution coming soonThe working Android version is undergoing final alignment with the iOS experience and BLE connection.
Google Play release to comeSupport and Apple review
A human contact and an always-available demonstration environment.
Laurent Fournier‑Calmet
laurent.fourniercalmet@gmail.com
+33 6 19 29 14 85
Open reference.sigl.ai, use its domino with the app, then test private mode, return to public, remote pad and private navigation to Directory.
The directory and demonstration servers run behind Caddy with automatic service restart.