Verify this Auditor Export

Drag the bundle in. Everything runs in your browser. No install, no upload, no internet.

Holding a check code from a set of questionnaire answers instead? Use the answer set check. That one asks Kanonik whether the sealed set exists and when it was sealed, so it needs a connection; this page never does.

Drop the bundle .tar.gz here, or a single-record proof .json or click to choose it. Nothing leaves this page.

You can check this bundle without asking Kanonik. What you still rely on Kanonik for: the pinned signing keys, the withheld-entries list and the prompt registry in this checker. This page runs the same 11 checks as chain/verify.py (plus a line counting any withheld entries), using only your browser's built-in cryptography. Each check is named in the report above, with what it establishes. The source is right here in this file; read it.

This is offline verifier version 2.7.15. A single-record proof (one sealed record a company handed you, as a .json file) is checked from version 2.4.0: its event hash, the signed record checkpoint over it, the verdict, the approval, and whether a newer version existed when the file was made. An export that contains a record-kind self-seal (one person accepting and sealing a routine record the tenant's author-may-self-seal policy permits) requires verifier version 2.0.0 or later; a two-act oversight trail (a governance record one person accepted and a second person sealed) is checked from version 2.1.0. An older copy still verifies a two-act export, it simply does not run the extra oversight check; a 1.x copy reports a record-kind self-seal as a separation-of-duties failure. Every earlier export, and every governance-kind or sole-admin case, verifies unchanged on the verifier it shipped with.