Verify a signed audit bundle

Manifest SHA-256 Check the notary

Want to see a valid answer? Use the self-test hash 47f38e885067f981ebde0e8ea59d508be472e5340f36bc7b1273fd39f83392ba — it is sha256("evalqa notary self-test"), corresponds to no customer bundle, and says so.

Also available from the terminal: evalqa verify <sha256>, or GET https://eval.qa/api/notary.php?h=<sha256>.

What a valid record says

Verification Record Valid: Manifest [hash] evaluated on [date] under Protocol v9.3 at Evidence Assurance Level EAL-2. Signature Verified. Zero customer data stored.

Three other answers are possible:

• Review required. The record is on automated status hold under the assurance recall protocol — we found a flaw in our own method or scoring, the customer has been notified, and a re-evaluation is in progress.
• No record. The hash is not on file. Either it was transcribed wrongly, the run was self-administered at EAL-1 (customer-reported evidence is never notarised), or the bundle was not produced by EvalQA.
• Not a SHA-256. The input is not 64 hexadecimal characters.

How to find the hash

1. Open the bundle’s manifest.json (it sits beside report.html in the S3 prefix or Snowflake stage the customer chose).
2. Copy the value of manifest_sha256. It is also printed in the footer of the Tier-1 board scorecard.
3. Optionally recompute it: sha256sum manifest.json must match, or the bundle has been altered since signing.

What this notary will never do

• Return a finding, a query, a table name, a score or a customer name. It does not have them.
• Issue a badge, a seal or a “certified” status. See why there is no badge.
• Answer for an EAL-1 self-run. Unverified evidence is labelled unverified, not laundered through a notary.

Evidence modes & EALs → Recall protocol →