Verifying a report

How to use it

Open /verify and paste the 64-character SHA-256 fingerprint from the report or the evidence file, or open the shared link that already carries it. You do not need an account.

What a match proves

• The fingerprint belongs to a report version that was sealed in Instica.
• Whether the version is the current one or a newer version has replaced it (the page shows the newer fingerprint).
• The jurisdiction, reporting period, version number, when it was prepared, and whether and when the customer signed it.
• The name of the signing key and its algorithm, so you can match it against the published key set.

What it does not prove

• It does not show quantities, product names, suppliers, fees or any customer data.
• It is not a regulator's approval or acceptance, and it says nothing about whether the figures are right.
• It does not show that the customer has submitted the report. The customer signs and submits in the regulator's or scheme's own portal.
• A file edited after it was prepared will not match, and an unknown fingerprint returns not found.

Checking an evidence archive

Choose an evidence ZIP on /verify. Your browser checks the signed manifest against the published key set and recomputes the SHA-256 of every file in the archive. The file is never uploaded.

A valid archive shows "Signature valid · no files changed". A changed, missing or extra file, or a manifest that does not match its signature, fails and names the files concerned.

Limits

Lookups are rate limited per client. The page does not send credentials and shared links are kept out of search indexes.