For auditors and reviewers

For auditors: check the evidence yourself

A customer has handed you a Provantix export. You do not have to take our word, or theirs. Here is what you hold, how to verify it on your own machine, and what a pass does and does not tell you.

Download the verification kit Verify in your browser Get an invite

What you receive

A manifest listing every file with its SHA-256, and the records, one per line.
The daily roots for the days involved, and a coverage statement as of the export.
Provantix's signature over the manifest, when the export was signed.
Where the customer's emitter seals its records, the seals and the emitter's key listing.
Where the export was made by the hosted service, proofs from our public transparency log.

Five steps

Fetch Provantix's published export keys yourself. Never use a key found inside the export.
Get the emitter's public key from the customer directly. That is what makes the emitter check independent of us.
Run the verifier in your browser, or the standalone one from the kit, on a copy.
Read which checks passed and which say not established. Each says why.
Compare the roots with the public transparency log, and mirror the log if you want to watch history.

Two implementations and a specification

A Node verifier and an independent Python one, checked against the same test vectors.
The format and algorithms in plain text, so you can write a third.
A signed sample export and a tampered one, with the expected output, to try before you rely on it.

Honesty, up front

What the evidence proves, and what it does not

What it proves

Nothing in the export changed after it was made, no record was removed from the middle of a chain, and each closed day still matches its root.
Provantix issued exactly this export, checked against keys you fetched.
With the emitter's key from the customer, that the customer's own emitter vouched for each record.

What it does not

That the agent reported everything it did, or that the host holding the emitter's key was uncompromised.
That the export meets your engagement standard. That is your judgement, and we are not asking you to take it from us.

The auditor verification kit — Verifiers, samples and the expected output.
How verification works
Trust: keys, custody and what we cannot do
The transparency log

Ask for a demo or a sample export

Tell us who you are and tick the demo box if you want one. We check your email with a one-time code, then reply with a sample export, a time, or an invite.