Witnessed events · EMS
The waste happens in a moving rig. The witness is whoever is driving.
Every EMS agency has to document that a second licensed person watched a controlled substance go into the sink. In a hospital that person is down the hall. In the field they are behind the wheel, or they are an ER nurse an hour later at handoff, signing for something they did not see.
Paper never solved that. Neither does a cloud form, because there is no coverage where the waste happens.
Why EMS is harder than the hospital version.
The requirement is the same. Everything around it is worse.
The witness is compromised by geography
One medic in the back, one driving. The only available second signature belongs to someone who was watching the road. Nobody is being careless — the crew configuration makes genuine observation physically difficult.
There is no signal where it happens
Rural county services, wildland fire, air medical, disaster deployments. Any system that needs a server at the moment of waste does not work at the moment of waste.
The delay looks like the crime
A record uploaded six hours after the event is indistinguishable, on paper, from a record written six hours late. That ambiguity is what an investigator has to resolve, and today they cannot.
What it takes to fix it in the field.
Four properties. None of them are about software preference.
Two people, provably two people
Both parties sign one record rather than making separate entries, each bound to their own credential. If both signatures resolve to the same key, the record refuses to seal — the check lives in the cryptography, not in policy.
Sealed on the device, with the network off
The record is created, signed and sealed entirely on the phone or tablet in the rig. No server round-trip is required to complete a waste, because there is frequently no server available.
The seal time governs, not the upload time
Records queue and sync when the unit comes back into coverage. Because the seal fixed the time and the chain order at the sink, a delayed upload reads as normal rather than suspicious — which is the opposite of how a late paper log reads.
Nobody can quietly change it, including us
Alter the drug, the amount, the time or either name and the record stops verifying. Anyone can confirm that independently, in a browser, without an account and without trusting the agency or Authyr.
Who this actually protects.
The medic who did it right
When an investigation opens, your best medic and your worst medic hold the same evidence: a signature and a memory. Most people pulled into a diversion investigation did nothing wrong, and today they are defended by a colleague’s recollection of a Tuesday four months ago.
The medical director
You personally carry the risk for a controlled-substance program run across dozens of units you cannot see. Gaps surface as broken chains rather than as discrepancies somebody has to happen to notice.
The agency under review
Evidence a state board or an insurer can verify without taking your word for it — because the record does not live only with the party being asked about it.
Where this actually stands.
We’d rather tell you this plainly than let you find out on a call.
What exists today
- The two-person seal is built, tested, and proven on live infrastructure — a two-signer record sealed by two real passkeys, synced, and independently verified
- Per-signer keys — each signer’s own passkey signs, so neither party (nor Authyr) could produce a sealed record alone
- Self-witnessing is refused at the key layer — two roles held by the same key are the same person, whatever the licence numbers say
- Offline-first sealing with a local queue — a rig with no coverage completes the waste and syncs later; the seal timestamp governs
- Selective disclosure — prove the waste event while the run number and patient reference stay withheld, mathematically bound to the same seal
- A working demo you can watch end to end, including with the network switched off
What does not exist yet
- Any deployment in a live EMS setting — the first agency would be the first agency
- Integration with ePCR, controlled-substance tracking software, or a dispensing cabinet
- Measured co-presence beyond same-device — NFC tap, UWB ranging and ultrasonic are designed into the schema but not implemented; today’s method proves shared hardware, and the record labels it as the weak claim it is
Three boundaries we state up front. This proves presence at the point of the event, not observation — someone standing at the sink on their phone satisfies every cryptographic check we make. Volumetric verification is out of scope: whether four of the six milligrams actually went down is a receptacle-analytics problem that belongs to a partner. And we are not selling you compliance — DEA requires the witnessed documentation, not an electronic form of it, and any vendor who tells you a rule forces this purchase is hoping you will not check.
Talk to us about a pilot.
We are looking for one agency that has actually been through a diversion investigation. The founder reads every message and will tell you honestly whether this is ready for what you need.