What it is
In plain words, before anything else.
A business identity key is a signing key bound to your domain, published where anybody can find it. Anything you issue can then be signed, and anybody can check the signature against your domain in one click.
It is the same idea as a wax seal, with the useful property that it cannot be copied. The point is not the cryptography, it is that the person receiving the document can settle the question themselves without ringing you.
What it costs you
The loss you never see happen.
Every document you send is unverifiable, so a fake in your name is just as convincing as the real thing. Your customer has no way to tell and neither do you.
It cuts the other way too. Careful buyers, and increasingly the software buying on their behalf, check identity before they commit. A business that cannot prove its own is the one that gets passed over quietly.
Check it yourself
Do not take our word for it. Look.
This takes about a minute, costs nothing, and needs no account with us or anybody else. A finding you have confirmed with your own eyes is the only kind worth acting on.
- 1
Visit yourdomain.com/.well-known/orbylon.json.
- 2
If it is there, your domain publishes an identity record.
- 3
If it is not, nothing you send can be checked by anybody. That is where almost every business stands right now.
What we found
Out of 186 businesses we checked ourselves.
- 186 of 186
had no way to prove that anything they issue really came from them. Not one exception in the whole set.
Counted from our own checks of 186 real businesses, measured on 2026-09-10, one count per business. No business is named and none of their reports is public. The full write ups are in what we found.
How we fix it
What we do, and what we leave alone.
Setting one up takes about five minutes and costs nothing. You prove the domain is yours by adding one record or one file, and the key is bound to it from then on.
The key is yours. We never take custody of anything, and nothing about this touches money.
Next
The checks closest to this one.
- V5
Your licence is real. Can anybody check it without ringing you?
A photograph of a certificate proves nothing. Anybody can make one in a minute. - V3
Anyone can send email as you until you stop them
A stranger can send mail from your address today, to your customers, and it will look genuine. - V2
Stopping somebody from quietly pointing your address somewhere else
Every visit starts by asking where your website lives. Without protection, that answer can be forged.
Is this one open on your site?
The free check runs all sixteen against your own address and tells you which came back clean, in the same plain words as this page.
Free. No signup. Takes about a minute.