What is actually in an evidence bundle?

The full-page screenshot, the HTML, the visible text, the response headers, the redirect chain and the recorded browser profile for each page, with a SHA-256 for every artifact, the audit Merkle root, the signature and the timestamp token.

How can somebody outside my company check it?

They upload the bundle to the public verifier. It recalculates the artifact hashes, rebuilds the Merkle path, checks the signature against the published key ledger and validates the timestamp. No Ironfang Audit account is needed to do that.

What stops you altering a record after the fact?

The signature covers the Merkle root, and the root changes if any artifact changes. The timestamp is issued by an independent authority over that root, so a later edit cannot be backdated. Verification does not ask our database whether a record is valid; it recomputes it.

Does the timestamp authority see my pages?

No. Only a SHA-256 imprint is sent for timestamping. The authority certifies when that digest existed and learns nothing about the site it came from.

Can I keep the evidence somewhere I control?

Yes. Export bundles to your own S3-compatible storage. Your credentials are sealed in a vault, and each object is written with its SHA-256 so the copy in your bucket verifies exactly as the original does.

What happens when my retention period ends?

The captured bytes are deleted and a record of the audit remains: what it observed, the hashes, the signing key and the date it was deleted. That record can no longer verify the content, so if a bundle needs to outlive hosted retention, download it, export it to your own storage or buy extended retention before it expires.

Is this a legal certification that my site was compliant?

No. Ironfang Audit records what its controlled browser observed and whether the rules you configured passed, and it makes that record independently checkable. It does not provide a legal opinion or certify compliance with any regulation.

What does capturing evidence cost?

Every account has a free allowance of page captures each month. Past it, with Pay as you go switched on, each successful page capture is charged at the published rates, within the monthly usage limit you set. A page that fails to capture is not counted.

Proof of what your website said, checkable by anyone

Ironfang Audit records the page, hashes every artifact, seals the audit with a signature and an independent timestamp, and hands you a bundle that somebody outside your company can verify without an account and without trusting us.

Create a free account Read the API docs

SHA-256 per artifact
Ed25519 signed
RFC 3161 timestamped
Verifiable without an account

Evidence bundleaudit-aw-2841.zip

VERIFIED

Artifact hashes: VALID
Merkle membership: VALID
Ironfang Audit signature: VALID
Trusted timestamp: VALID

Checked by the public verifier no account

The problem

A screenshot proves nothing on its own

The usual record is a screenshot in a folder, or a PDF in a ticket. Both are trivially editable, neither says when it was taken by anything other than a file date, and when somebody eventually disputes what a page said, the answer is your word against theirs.

Ironfang Audit seals the observation instead. Every artifact is hashed, the audit is signed, and an independent authority timestamps the root. The person checking it recomputes the whole chain from the bundle rather than asking our database whether the record is genuine.

POST /audit/verify/v1/bundles
Content-Type: application/zip

<the bytes of audit-aw-2841.zip>

200 {
  "valid": true,
  "artifact_hashes": "VALID",
  "signature": "VALID",
  "merkle_membership": "VALID",
  "timestamp": "VALID",
  "errors": []
}

Capabilities

What makes the record hold up

Each layer answers a different challenge: what was captured, that it has not changed, when it existed, and who can check it.

The whole observation
Screenshot, HTML, visible text, response headers, redirect chain and the browser profile that produced them, captured together rather than as a folder of unrelated files.
Hashed and sealed
Every artifact carries a SHA-256. Page evidence joins an audit Merkle tree, and the root is signed with Ed25519, so changing one byte invalidates the record.
Independently timestamped
An RFC 3161 authority certifies when the root existed. Only the digest is sent, so the authority learns nothing about your site and cannot be asked to reissue it later.
Checkable by anyone
A public verifier recalculates the hashes, rebuilds the Merkle path and checks the signature against a published key ledger. No account, and no need to trust our database.
A history that follows the page
Observations are tied to the logical page, so a record survives a URL move and you can compare what the same page said on two dates.
Custody you control
Export bundles to your own S3-compatible storage with sealed credentials, each object written with its hash so your copy verifies like the original.

Use cases

When somebody asks what the page said

Anywhere the answer needs to be checkable by a person who has no reason to trust you.

Regulated wording

Keep a checkable record of the risk warnings, disclosures and terms that were live on a date.

Advertising and claims

Record what a campaign page said while it ran, rather than reconstructing it from a content system afterwards.

Disputes and complaints

Answer "what did the page say on the 12th" with a record the other side can verify without taking your word for it.

Supplier and partner pages

Observe pages you do not control and keep proof of what they published.

Change records for auditors

Hand over a bundle and a verifier rather than a screenshot in a document nobody can check.

Internal sign-off

Attach the observation to the approval, so the record and the decision live together.

Check a bundle yourself

The verifier is public and takes no account. There is also a strict offline command-line verifier if you would rather not upload evidence to check it.

Open the verifier

Pricing

Counted per successful page capture

Evidence integrity is identical on every account, free or paid. Every account has a free allowance of page captures each month; past it, Pay as you go charges each capture once its evidence completes, within the monthly usage limit you set. A page that fails to capture is not counted. Evidence is hosted for a standard period, and for longer if you buy extended retention.

See Ironfang Audit pricing

Questions

Before you integrate

The details that decide whether this fits, without reading the whole reference first.

What is actually in an evidence bundle?: The full-page screenshot, the HTML, the visible text, the response headers, the redirect chain and the recorded browser profile for each page, with a SHA-256 for every artifact, the audit Merkle root, the signature and the timestamp token.
How can somebody outside my company check it?: They upload the bundle to the public verifier. It recalculates the artifact hashes, rebuilds the Merkle path, checks the signature against the published key ledger and validates the timestamp. No Ironfang Audit account is needed to do that.
What stops you altering a record after the fact?: The signature covers the Merkle root, and the root changes if any artifact changes. The timestamp is issued by an independent authority over that root, so a later edit cannot be backdated. Verification does not ask our database whether a record is valid; it recomputes it.
Does the timestamp authority see my pages?: No. Only a SHA-256 imprint is sent for timestamping. The authority certifies when that digest existed and learns nothing about the site it came from.
Can I keep the evidence somewhere I control?: Yes. Export bundles to your own S3-compatible storage. Your credentials are sealed in a vault, and each object is written with its SHA-256 so the copy in your bucket verifies exactly as the original does.
What happens when my retention period ends?: The captured bytes are deleted and a record of the audit remains: what it observed, the hashes, the signing key and the date it was deleted. That record can no longer verify the content, so if a bundle needs to outlive hosted retention, download it, export it to your own storage or buy extended retention before it expires.
Is this a legal certification that my site was compliant?: No. Ironfang Audit records what its controlled browser observed and whether the rules you configured passed, and it makes that record independently checkable. It does not provide a legal opinion or certify compliance with any regulation.
What does capturing evidence cost?: Every account has a free allowance of page captures each month. Past it, with Pay as you go switched on, each successful page capture is charged at the published rates, within the monthly usage limit you set. A page that fails to capture is not counted.

Less to operate. More to ship.

Capture your first sealed record

Create an account, add a site and run an audit. The evidence chain is the same on a free account as on a paying one.

Create a free account Read the API reference

Evidence integrity is identical on every account, paid usage stays within the limits you set, and no card is required to start.

Proof of what your website said, checkable by anyone

A screenshot proves nothing on its own

The whole observation

Hashed and sealed

Independently timestamped

Checkable by anyone

A history that follows the page

Custody you control