networks · layers · bridges
One record, many networks
The Ever network is not one blockchain. A patient's record stays encrypted on their own devices and storage. A consortium chain run by member organisations records who accessed what. Public chains are used only to timestamp proofs, so no single company, Ever included, has to be trusted.
why layers
Health data cannot live on a chain. Proof that it was handled correctly can.
A record on a public chain could never be deleted or kept private. So the record itself is encrypted and stored off-chain, and only a fingerprint of the access history goes on-chain. Each layer adds a stronger guarantee for that fingerprint, at a higher cost.
Nothing readable on any chain
Records are encrypted on the patient's device before they leave it. A single 32-byte Merkle root can commit to millions of access records; patient addresses are never written on-chain.
Patients never pay gas
Account and device registration go through a relay contract (meta-transactions), so a patient never needs a wallet balance. Registering an account is always free.
Verifiable anywhere
Anyone holding a proof can replay it to the root and check that root on any chain it was anchored to. The block timestamp is the evidence.
the layers
Cascading tiers
Anchoring to a tier writes the proof root to that tier and every tier below it: a tier-2 anchor lands on the consortium chain, Polygon and Arweave. Costs below are the approximate figures in the protocol documentation.
| Tier | Layer | Role | Cost | Run by | Status |
|---|---|---|---|---|---|
| 0 | ConsortiumHyperledger Besu, free gas | Always-on base layer. Records that an access happened and anchors batches of access-log proofs. | $0 per transaction | Validators: member organisations | in development |
| 1 | Public layer 2Polygon | A public timestamp anyone can check without trusting the consortium. | about $0.01 per anchor | Public network | planned |
| 2 | PermanentArweave | A permanent copy of the proof root that outlives any one organisation. | about $0.005, paid once | Public network | planned |
| 3 | MaximumEthereum and Bitcoin | The most neutral and censorship-resistant record available. | about $1 to $10 on Ethereum; free via OpenTimestamps on Bitcoin | Public networks | planned |
A hospital that hosts its own stack can collapse the ladder to a single tier, for example a private chain only. With anchoring switched off, the service computes the root and the planned cascade and submits nothing.
network maturity
draft for discussionHow the network grows from one operator to many
A network is only as trustworthy as the number of organisations that would have to collude to break it. These four levels describe the path. They are a proposal for the protocol's future, open to change through governance.
- level 1
Emerging
Ever runs the consortium validators. Proofs are public and anyone can verify them, so an operator who misbehaves can be caught.
- Access-log roots anchored on the consortium chain
- Verification documented and runnable by anyone
- Records encrypted on the patient's device; no record content on any chain
- level 2
Developing
Hospitals and other member organisations run validators alongside Ever. No single organisation can rewrite the access history alone.
- Validators run by several independent organisations
- Roots also anchored to a public chain
- Published security review of the contracts
- level 3
Maturing
Ever is one operator among many. A small group could still pause the network in an emergency, under published rules.
- Member organisations hold a majority of validators
- Protocol changes go through the public proposal process
- Any patient can export their record and leave
- level 4
Robust
No single organisation, including Ever, can stop the network or change its history. This is the aim, not today's state.
- Open governance across countries
- Emergency powers removed or held by a broad council
- Independent implementations of the protocol
As with any network, age and real use count as much as design. A level is reached when its conditions hold in production, not when they are written down.
bridges
Bridges carry records and proofs, not money
Every hospital system, laboratory, device and chain was built separately and cannot read the others natively. A bridge connects two of them. On the Ever network there are two kinds, and they make different trust assumptions.
| Operator-trusted bridge | Proof-verified bridge | |
|---|---|---|
| Who you trust | The bridge operator: a hospital, a regional exchange or Ever. | Cryptography and the underlying chains. A proof checks out or it does not. |
| What crosses | Encrypted records, delivered to a patient's address or a clinician's inbox. | A 32-byte proof root. Never a record, never a patient address. |
| What can go wrong | The operator delays or withholds a delivery. It still cannot read the record, because it holds no key. | A bug in a contract or the verification code. |
| Where Ever uses it | Connected mode: hospital data arriving in the patient's mailbox; sharing with a clinician. | Anchoring: the same root written to each tier, checkable on any of them. |
The rule for every bridge
A bridge may delay a delivery. It must never be able to read, change or keep a record. Keys stay with the patient, so in connected mode the backend is a mailbox, not a brain. Anything a bridge can see in clear text is a design defect.
Risks, stated plainly
- • A contract or verification bug could accept a false proof.
- • An operator-trusted bridge can censor or delay deliveries.
- • A public chain's fees or availability can change; that is why the ladder has several tiers and the consortium tier costs nothing.
questions
Frequently asked questions
How do I know a network is part of Ever?
It runs the published Ever contracts (account registry, seed vault, access-log anchor, trusted forwarder) and anchors to the tier ladder described here. Its anchored roots can be checked with the same verification steps as any other part of the network.
Is there a token?
The protocol as documented has no token. Anchoring costs are covered by the subscription a patient or organisation chooses; registration is free. Any change to that would go through the public proposal process.
Why not put everything on one chain?
No single chain is free, permanent, private and neutral at once. The consortium chain is free and fast; public chains add neutrality and permanence. Layering the proof lets each use match its cost.
Is health data stored on a blockchain?
No. Records are encrypted on the patient's device and stored as encrypted files addressed by content (IPFS or S3-compatible storage). Chains hold only proof roots and public keys.
What happens if Ever disappears?
The encrypted record stays on storage the patient can reach, the keys stay with the patient, and the anchored proofs stay on the public chains. The protocol is designed to outlive the company.
Why is there no 'official' Ever chain?
The protocol is designed to be blockchain-agnostic: the contracts run on any EVM-compatible chain, and the original 2017 design used a different ledger altogether. What is fixed is the contract interface and the verification rule, not the chain.
Protocol documentation
Join the transformation today.
Ever was created from the ground up in partnership with pioneering engineers and expert physicians. Our innovations solve real-life issues that inhibit medical institutions around the world.
