Check a record without trusting us.

Every scan record carries a receipt signed with our Ed25519 key. If a file was changed after the scan, its hash won’t match the receipt; if the receipt was changed, the signature won’t verify.

Scan ID Look up

Verify it yourself

The signed message is the receipt as canonical JSON: keys sorted, no spaces (separators , and :), UTF-8. The public key:

pyLFRvVMHCulHJYrB0Nqcki8isf323VXMb9yzs+0oaY=   (key id f421150cbab2bcd7)

With Python and the cryptography package:

import base64, json, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

data = json.load(urllib.request.urlopen("https://compliancescanner.io/api/verify/SCAN_ID"))
msg = json.dumps(data["receipt"], sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
key = Ed25519PublicKey.from_public_bytes(base64.b64decode("pyLFRvVMHCulHJYrB0Nqcki8isf323VXMb9yzs+0oaY="))
key.verify(base64.b64decode(data["signature"]), msg)   # raises if anything was altered
print("valid")

Keep a copy of the public key with any record you file. If we ever rotate keys, old keys stay published with their validity dates.