What is actually in an evidence bundle?

The full-page screenshot, the HTML, the visible text, the response headers, the redirect chain and the recorded browser profile for each page, with a SHA-256 for every artifact, the audit Merkle root, the signature and the timestamp token.

How can somebody outside my company check it?

They upload the bundle to the public verifier. It recalculates the artifact hashes, rebuilds the Merkle path, checks the signature against the published key ledger and validates the timestamp. No Ironfang Audit account is needed to do that.

What stops you altering a record after the fact?

The signature covers the Merkle root, and the root changes if any artifact changes. The timestamp is issued by an independent authority over that root, so a later edit cannot be backdated. Verification does not ask our database whether a record is valid; it recomputes it.

Does the timestamp authority see my pages?

No. Only a SHA-256 imprint is sent for timestamping. The authority certifies when that digest existed and learns nothing about the site it came from.

Can I keep the evidence somewhere I control?

Yes. Export bundles to your own S3-compatible storage. Your credentials are sealed in a vault, and each object is written with its SHA-256 so the copy in your bucket verifies exactly as the original does.

What happens when my retention period ends?

The captured bytes are deleted and a record of the audit remains: what it observed, the hashes, the signing key and the date it was deleted. That record can no longer verify the content, so if a bundle needs to outlive your plan's retention, download it or export it to your own storage before it expires.

Is this a legal certification that my site was compliant?

No. Ironfang Audit records what its controlled browser observed and whether the rules you configured passed, and it makes that record independently checkable. It does not provide a legal opinion or certify compliance with any regulation.

Website evidence

Proof of what your website said, checkable by anyone

Ironfang Audit records the page, hashes every artifact, seals the audit with a signature and an independent timestamp, and hands you a bundle that somebody outside your company can verify without an account and without trusting us.

Create a free account Read the API docs

SHA-256 per artifact
Ed25519 signed
RFC 3161 timestamped
Verifiable without an account

Evidence bundleaudit-aw-2841.zip

VERIFIED

Artifact hashes: VALID
Merkle membership: VALID
Ironfang Audit signature: VALID
Trusted timestamp: VALID

Checked by the public verifier no account

The problem

A screenshot proves nothing on its own

The usual record is a screenshot in a folder, or a PDF in a ticket. Both are trivially editable, neither says when it was taken by anything other than a file date, and when somebody eventually disputes what a page said, the answer is your word against theirs.

Ironfang Audit seals the observation instead. Every artifact is hashed, the audit is signed, and an independent authority timestamps the root. The person checking it recomputes the whole chain from the bundle rather than asking our database whether the record is genuine.

POST /audit/verify/v1/bundles
Content-Type: application/zip

<the bytes of audit-aw-2841.zip>

200 {
  "valid": true,
  "artifact_hashes": "VALID",
  "signature": "VALID",
  "merkle_membership": "VALID",
  "timestamp": "VALID",
  "errors": []
}

Capabilities

What makes the record hold up

Each layer answers a different challenge: what was captured, that it has not changed, when it existed, and who can check it.

The whole observation

Screenshot, HTML, visible text, response headers, redirect chain and the browser profile that produced them, captured together rather than as a folder of unrelated files.

Hashed and sealed

Every artifact carries a SHA-256. Page evidence joins an audit Merkle tree, and the root is signed with Ed25519, so changing one byte invalidates the record.

Independently timestamped

An RFC 3161 authority certifies when the root existed. Only the digest is sent, so the authority learns nothing about your site and cannot be asked to reissue it later.

Checkable by anyone

A public verifier recalculates the hashes, rebuilds the Merkle path and checks the signature against a published key ledger. No account, and no need to trust our database.

A history that follows the page

Observations are tied to the logical page, so a record survives a URL move and you can compare what the same page said on two dates.

Custody you control

Export bundles to your own S3-compatible storage with sealed credentials, each object written with its hash so your copy verifies like the original.

Use cases

When somebody asks what the page said

Anywhere the answer needs to be checkable by a person who has no reason to trust you.

Regulated wording

Keep a checkable record of the risk warnings, disclosures and terms that were live on a date.

Advertising and claims

Record what a campaign page said while it ran, rather than reconstructing it from a content system afterwards.

Disputes and complaints

Answer "what did the page say on the 12th" with a record the other side can verify without taking your word for it.

Supplier and partner pages

Observe pages you do not control and keep proof of what they published.

Change records for auditors

Hand over a bundle and a verifier rather than a screenshot in a document nobody can check.

Internal sign-off

Attach the observation to the approval, so the record and the decision live together.

Check a bundle yourself

The verifier is public and takes no account. There is also a strict offline command-line verifier if you would rather not upload evidence to check it.

Open the verifier

Pricing

One credit per successful page capture

Evidence integrity is identical on every plan, including the free one. You are charged when a capture completes, infrastructure failures on our side cost nothing, and there are no overage charges on any plan. Plans differ in volume, sites and how long we host the evidence for you.

See Ironfang Audit pricing

Questions

Before you integrate

The details that decide whether this fits, without reading the whole reference first.

What is actually in an evidence bundle?: The full-page screenshot, the HTML, the visible text, the response headers, the redirect chain and the recorded browser profile for each page, with a SHA-256 for every artifact, the audit Merkle root, the signature and the timestamp token.
How can somebody outside my company check it?: They upload the bundle to the public verifier. It recalculates the artifact hashes, rebuilds the Merkle path, checks the signature against the published key ledger and validates the timestamp. No Ironfang Audit account is needed to do that.
What stops you altering a record after the fact?: The signature covers the Merkle root, and the root changes if any artifact changes. The timestamp is issued by an independent authority over that root, so a later edit cannot be backdated. Verification does not ask our database whether a record is valid; it recomputes it.
Does the timestamp authority see my pages?: No. Only a SHA-256 imprint is sent for timestamping. The authority certifies when that digest existed and learns nothing about the site it came from.
Can I keep the evidence somewhere I control?: Yes. Export bundles to your own S3-compatible storage. Your credentials are sealed in a vault, and each object is written with its SHA-256 so the copy in your bucket verifies exactly as the original does.
What happens when my retention period ends?: The captured bytes are deleted and a record of the audit remains: what it observed, the hashes, the signing key and the date it was deleted. That record can no longer verify the content, so if a bundle needs to outlive your plan's retention, download it or export it to your own storage before it expires.
Is this a legal certification that my site was compliant?: No. Ironfang Audit records what its controlled browser observed and whether the rules you configured passed, and it makes that record independently checkable. It does not provide a legal opinion or certify compliance with any regulation.
What does capturing evidence cost?: One credit per successful page capture. Infrastructure failures on our side cost nothing, and there are no overage charges on any plan.

Less to operate. More to ship.

Capture your first sealed record

Create an account, add a site and run an audit. The evidence chain is the same on the free plan as on every paid one.

Create a free account Read the API reference

Evidence integrity is identical on every plan, with no overage charges and no card required to start.