Verify a document

If someone has sent you a compliance document we produced, you can check here that it is genuine and has not been altered since we issued it. You do not need an account, and you do not have to trust the person who sent it to you.

Two ways to check

The code is printed on the document, near the end of a PDF and in the header rows of a spreadsheet. It looks like A1B2-C3D4-E5F6. It is the quick route.

The fingerprint is stronger, because it does not rely on anything printed on the file. Compute it yourself from the file you actually hold:

sha256sum report.pdf            # Linux
shasum -a 256 report.pdf       # macOS
certutil -hashfile report.pdf SHA256   # Windows

Paste the 64-character result above. If it does not match what we hold, the file you were sent is not the file we issued.

What verification does and does not settle

It settles that a document came from us, when it was issued, and that not a byte has changed since — backed by a trusted timestamp from an independent authority that you can check without involving us.

It settles nothing about the company the document describes. Public registers can be wrong, out of date, or silent about something that happened. A verified document proves a check was run and recorded honestly — not that its conclusion was right. How we gather evidence, and where it stops, is set out in our methodology.