not.bot blog

did:julia is now a registered DID method

2026-09-15T00:00:00Z

did:julia, the decentralized identifier method behind not.bot™, is now listed in the W3C DID Methods registry. Our registration was merged on September 1, 2026.

That gives developers exploring decentralized identity a public entry point to our method, its specification, and the code that implements it.

What is a DID method?Permalink to What is a DID method?

A decentralized identifier, or DID, is an identifier whose controller can prove control using cryptographic keys. A DID method defines how those identifiers are created, how their state is read, and how they are updated or deactivated.

Our method is called did:julia. It uses the Chia blockchain to keep a verifiable record of an identity’s keys and changes over time. It is the identity foundation used by not.bot.

Why it matters for not.botPermalink to Why it matters for not.bot

When someone checks a signature, they need to be able to connect the signing key to the identity that used it. They also need that connection to survive ordinary changes, such as the signer replacing a key.

With did:julia, the identifier stays the same when keys change. Its history can be checked from the blockchain, so an older signature can still be verified against the identity that made it after a routine key rotation.

The method also lets a verifier read the identity’s current state from a Chia node without asking Julia Social to supply that record. We publish the on-chain implementation so developers can inspect the rules governing identity, credentials, revocation, and recovery.

These are useful foundations for the question not.bot helps people answer: who stands behind this interaction or piece of signed content?

A public specification developers can inspectPermalink to A public specification developers can inspect

Registration makes the method easier to discover and evaluate. The registry links to our method specification, which describes the identifier format, lifecycle, security model, and privacy considerations. Registry inclusion is not W3C certification or endorsement.

The on-chain protocol is running on Chia mainnet. The specification also identifies work still to come: publishing and retrieving DID Documents through Chia DataLayer is specified but not yet implemented. A DID Document describes an identifier and associated verification information; the current not.bot flow does not depend on that publication path.

For a closer look, read our did:julia technical specification or explore how not.bot works.

not.bot selected as a Venture Atlanta 2026 Showcase Company

2026-09-15T00:00:00Z

Venture Atlanta has selected Julia, the company behind not.bot™, as a 2026 Showcase Company. The conference takes place October 14–15 at the Woodruff Arts Center and Atlanta Symphony Hall.

You can find us listed as Julia Social (not.bot) in the Venture Atlanta company lineup.

What we are buildingPermalink to What we are building

We build tools that let you verify the human behind an interaction or a signed piece of content. With not.bot Sign My Work, a recipient can check who signed an artifact and compare it with the encrypted known-good copy. not.bot Verify lets a site request and check credentials presented through the not.bot app.

We thank the Venture Atlanta team for selecting us, and the investors and supporters who have helped us reach this point.

See not.bot in actionPermalink to See not.bot in action

You can watch our three-minute Verify walkthrough without installing the not.bot app. It shows a site requesting information, a human responding in the app, and the response the site receives.

Chia Network will also feature us in its public Community Spotlight on September 17 at 11 a.m. Pacific / 2 p.m. Eastern.

What If We Get Hacked?

2026-09-04T00:00:00Z

You've probably seen the story by now: a dark web marketplace called Nexus popped up selling more than 153 million driver's licenses, front and back, some even in infrared and UV. All of it apparently pulled from one identity verification company that works behind the scenes at hotels, rental car counters, convenience stores, and sportsbooks. Brian Krebs, the security reporter who broke the story, found his own license in the data. So did a sitting U.S. cabinet official. Gizmodo has a good overview: Identity Verification Is Broken: The 153 Million Driver's Licenses Now for Sale Are Proof.

This wasn't a one-off screwup. It's what happens by default whenever a company scans your ID and keeps the scan. A company that does that is sitting on a stash of your most sensitive documents, and stashes like that eventually get found by someone patient enough to look.

Privacy is the core ethos behind everything we build at Julia Social. We design systems to avoid collecting sensitive data at all, rather than promising to protect data we didn't need to have in the first place.

So when people ask us "what if you get hacked," we don't answer "we're unhackable." Nobody can promise that. We answer with the specifics: what would and wouldn't be exposed, and why.

If someone broke into our computersPermalink to If someone broke into our computers

They would NOT get:

Your passport or ID information
Your name, email, or phone number
Any payment information
Your location or your phone's contacts
The contents of anything you've signed or approved through the app
A list of which websites or people you've interacted with
Which not.bot identity in our system belongs to you (unless you've earned a Verified Signer badge, explained below)

None of that information ever gets saved on our end in the first place, so there's nothing sitting there to steal. You can't leak what was never written down.

What they WOULD get is a much smaller set of details that, on its own, doesn't tell them who you are: internal ID numbers our system uses to keep track of accounts, a couple of details tied to app subscriptions that can't be traced back to your Apple or Google account, and encrypted backups (your recovery data, your contacts list) that we can't read either. If you opted into our anonymous usage statistics, they'd also get weekly aggregate counts that contain no identifiers. None of it links to your real identity by itself.

One exception: if you've earned a "Verified Signer" badge, we do keep a link between your public alias and your account, so we can turn off the badge if a subscription lapses. That's the one case where we hold more than usual.

One more caveat: even the small amount of identity data we do keep encrypted and locked away isn't something one break-in can unlock. Getting to it would require breaking into three separate systems at once, one of which isn't connected to the internet at all, and even then, unlocking one person's information takes days of computing work per person. There's no button that unlocks everyone at once.

If someone attacked the blockchain part of our systemPermalink to If someone attacked the blockchain part of our system

Even less to find here. The blockchain only ever sees random-looking ID numbers and "this credential was cancelled" flags, never your name, your info, or anything personal. We also generate a steady stream of decoy activity that looks identical to real people signing up or recovering their accounts, so even someone watching the blockchain can't tell which activity is real or connect any of it back to a real person.

Why we built it this wayPermalink to Why we built it this way

Nothing about us should be a single point of failure for who you are. That's why unlocking anyone's data takes multiple separate parties acting together instead of one break-in, why using the app day-to-day never has to touch our servers at all, and why most of what other companies collect by default, we never collect in the first place.

We'd rather show you where the seams are than tell you there aren't any.

not.bot Verify is available

2026-08-26T00:00:00Z

Your site cannot tell whether the person using an account is human. A document-and-selfie check at signup establishes who opened the account. It says nothing about who is using that account a month later, after the credentials have been shared, sold, or taken over.

not.bot Verify checks at every login instead of once at signup, with about as much friction as ordinary MFA. It answers three questions for your site: is this a human, does this human meet an age threshold, and have you seen this human here before. It answers them without collecting personal information about the person behind the account.

Site Passes recognize a returning humanPermalink to Site Passes recognize a returning human

Until now your site had no reliable way to tell that two accounts belong to one person. A Site Pass is a unique identifier for one human on one site, and building it gathers no identity information about them. That person can come back later under a different alias, and the Site Pass still identifies them as the same human.

Age checks that gather nothing elsePermalink to Age checks that gather nothing else

Legislators are writing age-verification requirements into law, and social platforms have to enforce them. Most age-checking products answer the question by collecting a large amount of information about the person first.

Julia Social collects no personal information about your users, and no biometrics. Your site can check an age threshold at every login without gathering anything else about them.

The Meta settlement announced this week puts a clock on this. Meta agreed to pay up to $18 billion to settle child-safety claims brought by 48 state attorneys general, and to strengthen how it checks the ages of its users. The rest of the industry has an incentive to move too: roughly $5.3 billion of that total is contingent on TikTok and YouTube adopting similar limits. Verify lets a site meet an age requirement without taking on a pile of personal data to protect.

It runs in your infrastructurePermalink to It runs in your infrastructure

The Verify SDK is open source, and Verify runs inside your own environment. No data about which users your site interacts with ever leaves that environment.

Your instance keeps working if our servers slow down or go offline, and you take a new version when it suits you rather than when we ship one. To install it fast, point your coding agent at the docs.

See it workPermalink to See it work

Try the live demo, or watch the pre-recorded walkthrough beside it.

Compare us to the alternativesPermalink to Compare us to the alternatives

We publish an evaluation framework: criteria for judging any human-verification product, ours included. Point an LLM at it and ask it to compare not.bot against World ID, Self Protocol, hCaptcha, reCAPTCHA, Yoti, Persona, Stripe Identity, and Apple and Google ID.

Where to go nextPermalink to Where to go next

What Verify does and how it works
Install instructions
Learn about not.bot, or take the deep dive into the technology

For Chia developers, the on-chain protocol is open-source Chialisp, described in the protocol documentation.

If you would rather work through this with an LLM, we keep machine-readable resources for that. Every document has a Markdown twin: append .md to its URL. llms.txt lists the corpus, and llms-full.txt carries all of it in one file, close to a megabyte of it.

not.bot blog

did:julia is now a registered DID method

What is a DID method?#Permalink to What is a DID method?

Why it matters for not.bot#Permalink to Why it matters for not.bot

A public specification developers can inspect#Permalink to A public specification developers can inspect

not.bot selected as a Venture Atlanta 2026 Showcase Company

What we are building#Permalink to What we are building

See not.bot in action#Permalink to See not.bot in action

What If We Get Hacked?

If someone broke into our computers#Permalink to If someone broke into our computers

If someone attacked the blockchain part of our system#Permalink to If someone attacked the blockchain part of our system

Why we built it this way#Permalink to Why we built it this way