An evidence pack is the record of what happened on your workspace's cases — built from the same append-only, hash-chained audit log every action already writes to.
Before you start
You need evidence.generate permission. Owners, admins, and auditors all have it —
generating and downloading evidence is the one write-shaped thing an auditor's
otherwise read-only role can do, by design.
Steps: generating a pack
- Go to Evidence.
- Choose the scope — the case, product, or time range the pack should cover.
- Generate the pack. You get a document plus a verification code printed in its footer.
- Download it and share it with whoever needs it — a regulator, an internal reviewer, or your own auditor.
Steps: verifying a pack independently
Anyone holding the pack — not just someone signed into your workspace — can check that it's genuine:
- Go to the public
/verifypage. No sign-in required. - Enter the verification code from the pack's footer.
- Declara confirms when the pack was issued, what it covers, and how much of the audit chain sits behind it — without showing any of the pack's actual contents.
What you should see
A verified pack shows its chain as intact. Contents are never displayed on the verify page itself; the check only confirms the pack is genuine, not what's in it.
What a broken chain means
Every workspace's audit log has database-level grants that revoke UPDATE and
DELETE on the audit table — the chain is tamper-evident, not tamper-proof. A pack
whose chain fails verification is not something to troubleshoot yourself; treat it
as a support escalation.