Every Aegis Firma report is cryptographically signed, Merkle-anchored, and independently verifiable. An auditor can confirm any document is authentic — without trusting us.
The full chain from document generation to public verification. No black boxes.
When you generate a compliance report, we capture the complete document content plus metadata: your organization ID, document type, and exact generation timestamp.
We compute a SHA-256 cryptographic hash of the normalized document data. This 64-character hex string is a unique fingerprint — change even one character in the document and the hash changes completely.
Our server signs the hash using an Ed25519 private key stored in a hardware-protected secret manager. Ed25519 is the same algorithm used by SSH, Signal, and modern TLS. The private key never leaves our infrastructure.
The document hash and a verification URL are appended to every report. Anyone can paste that hash at aegisfirma.com/verify/[hash] to confirm the document is unmodified.
Every 24 hours, all document hashes from that day are combined into a Merkle tree — a tamper-evident data structure where changing any single document would change the root. The Merkle root is published to /.well-known/merkle-roots.json as an append-only public log.
Auditors, regulators, and clients can verify any document independently — no login required. Green check means the document is authentic. Red warning means it was altered after generation.
The compliance score is only as trustworthy as the assessment it came from. We sign the answers too.
When you submit an assessment, we compute a SHA-256 hash of your answers and sign it with the same Ed25519 key. If anyone alters the stored answers, the signature breaks.
Each assessment session records: start time, browser fingerprint, disconnect events, and submission timestamp. Unusual patterns (rapid completion, offline periods) are noted in the integrity report.
Contradictory answers are flagged automatically. If you say "no AI systems" in question 3 but list tools in question 15, the integrity report notes the inconsistency.
Every report receives a 0–100 integrity score combining: signature validity (40 pts), session continuity (20 pts), attention checks (20 pts), consistency (10 pts), and completion time (10 pts).
Every piece of evidence you upload is tracked immutably — answering the auditor's first question before they ask it.
On every access, evidence files are re-hashed. Hash drift triggers an immediate tamper alert. Enterprise customers can view the full access history from the auditor view.
Our Ed25519 public key is published at /.well-known/report-public-key.pem. Anyone can download it and independently verify any document signature offline — without accessing our servers.
Key rotation: if we ever rotate the signing key, the old public key remains published alongside the new one, so documents signed with the prior key remain verifiable.
No. Once generated, a document's hash is recorded in our report_signatures table. Any alteration — by anyone, including us — produces a different hash, which would fail verification. Our own engineering team cannot forge a valid signature without access to the Ed25519 private key, which is stored in a hardware-protected secrets manager.
The daily Merkle root is published to a public append-only log at /.well-known/merkle-roots.json. Once published, any independent observer can check whether a given document hash was included in that day's batch. Deleting the hash from our database would not affect the public Merkle log.
Yes. The /verify/[hash] page is fully public — no account required. Anyone can paste a document hash and receive a verified or failed result.
The integrity score (0–100) measures the quality of evidence behind the report. 100/100 means: document signed, assessment completed continuously, all attention checks passed, no answer contradictions, reasonable completion time. Lower scores indicate flags that an auditor may want to review.
Every evidence file upload records the uploader's user ID, a SHA-256 hash of the file bytes, the server timestamp, and the upload IP address. On every subsequent access, the file is re-hashed. If the stored hash no longer matches, a tamper alert is triggered. The full access history is available to Enterprise auditor roles.
Before your next audit, share this URL. It answers every "how do we know this hasn't been altered" question before they ask.