What Is Open and Why

The Earthlings People

Why this document exists

We assert that Earthlings is verifiable. An assertion like that only means something when one can state precisely what is being verified and by what method. So instead of the general formula "our code is open" we publish the exact boundary: what is open, what is closed, and for what reason.

The principle. What is open is whatever the verifiability of the people depends on: who is a member, how they became one, how many of us there are, and how a vote is counted. What is closed is whatever publishing would add nothing to verifiability while creating risk for members: the server wrapper and the handling of personal data.

What is open

Component	Where	License
The EarthlingPassportV2 smart contract	github.com/earthlingsorg/earthlings-contracts	MIT
Architectural documentation	the `/docs` folder of the same repository: identity model, data minimization, security, reputation, contribution flow	MIT
The contract address and all of its transactions	0x20e7962878429B803E35F83ba34eD291afEC2Be4	public data
The registry of passports	the Polygon blockchain, read directly from the contract	public data
The public channel for DAO votes	snapshot.org, the earthlings-dao.eth space	public data
The on-chain treasury	0xaEC7016218f7883bf6e47a2C932FdE6d822086C0	public data

What is closed, and why

Component	Reason
The server side of the platform	It contains the logic of access to member accounts. Publishing it before an independent audit raises the risk of accounts being broken into, while adding nothing to the verifiability of the people.
The identity verification system	It works with documents and biometrics. Here closedness is part of protecting personal data, not concealment. How data minimization is built is described in the open documentation.
Deployment infrastructure	It contains server configuration. Publishing it would be a map for an attacker.

None of the closed components determines who is an earthling or how a vote is counted. That is determined by the open smart contract.

What you can verify right now, without trusting us

The rules of the passport. Read the contract source in the repository: the passport is non-transferable, one per wallet, and the holder can burn it themselves.
The size of the people. Call the contract's totalSupply. That number is not stated by us - it is stated by the blockchain.
Whether a given address holds a passport. Call balanceOf. The answer is 1 or 0.
DAO votes. Open the Snapshot space and see the proposals, the votes and the signatures. Every vote is signed by the wallet that cast it - we can neither add a vote nor forge someone else's.
The right to vote. Snapshot asks our server whether an address holds a passport. That step has to be trusted at the moment of voting - but not afterwards: the addresses of everyone who voted are public, and anyone can check each of them against the contract on Polygon themselves. A discrepancy would be visible.

We describe the last point openly because it is the one place in the chain where our server takes part. We would rather name it ourselves than leave it as a find for whoever comes checking.

What is not there yet

An honest list of what is stated as a principle but not yet done:

The contract source code is published in the repository but is not yet verified in the block explorer. That means the correspondence between the published source and the deployed bytecode still has to be checked by hand. Verification is in progress.
No independent security audit has been carried out. One is planned before operations expand.
The Treasury smart contracts are not deployed. Only the passport contract is; the internal economy of participation is for now kept in the platform's own ledger.
The public voting channel is deployed and technically working, but no substantive votes have been held in it yet.
A bug bounty program is stated as a principle but has not been opened yet.

The right of reproduction

The registry of passports lives on the blockchain, not on our servers, and the contract code is open. From this follows something practical: if the infrastructure is shut down or its operation is captured, the community can build a new platform against the same registry. The people and their passports carry over; the server wrapper is replaceable.

So the closedness of the server side does not cancel the right of the people to continue without the founders. The marks of a lawful continuation - the immutable core preserved, the will of verified people, and the continuity of procedures - are described in Roadmap for the Transitional Period.

Updated: 28 July 2026