ComplyZero
Start free

Seal Check

Handed a ComplyZero export?Check it's genuine.

Seal Check confirms that an evidence export was issued by ComplyZero for the organisation it names, and that nothing in it has been changed, removed or added since. You don't have to take the sender's word for it.

Drop the export's .zip file here

or

Use the .zip exactly as you received it. No need to unzip it.

Free for anyone. No account needed.

What Seal Check confirms. Three things, in order.

  1. The signature.

    Every export ends with a manifest listing each file's fingerprint, signed with ComplyZero's key. Seal Check confirms that signature against our published public keys, so you know who issued it.

  2. Every file.

    Each file must match the fingerprint and size the signed manifest gives it, in the order ComplyZero writes them. Nothing added, nothing missing.

  3. Every record.

    Every record is fingerprinted when it is written. The check recomputes each fingerprint from the record's own contents, so a change to a single record shows.

Need it for your working papers? Keep the full report.

The free verifier prints a report of every check it ran, covering every file and every record, ready to file with your audit evidence. Same checks as Seal Check, same result.

node verify-evidence-package.mjs consent-export.zip

Good to know

Who is Seal Check for?

Anyone a company hands its ComplyZero evidence to: an auditor, a regulator, a lawyer, an enterprise customer reviewing a supplier, or the person the records are about.

What does a passing check prove?

That ComplyZero issued the export for the organisation it names, and that every file and record in it is exactly as it was then. It doesn't show when the export was made, or anything about records outside it. The result lists those limits.

What if the check fails?

Ask the sender for the export exactly as it was downloaded, and check that. If it still fails, the file isn't what ComplyZero issued, so don't rely on it.

Why does a re-zipped export fail?

Seal Check accepts only the ZIP exactly as ComplyZero wrote it, byte for byte, so a match means it is the very file we issued. Unzipping and zipping again rewrites the file even when nothing inside changed. Ask the sender for the original download.

How do I know it's the file the sender meant?

Compare the file fingerprint (SHA-256) in the result with the one the sender gives you. In ComplyZero it is shown as the ZIP fingerprint beside each export, under How to check it.

Which exports can I check?

Consent evidence exports, for a website or for people, and offline evidence packs. These are the exports ComplyZero seals.