Skip to content
Declara
⌘K
compliance-ownerauditor

Export and independently verify an evidence pack

Was this page helpful?

An evidence pack is the record of what happened on your workspace's cases — built from the same append-only, hash-chained audit log every action already writes to.

Before you start

You need evidence.generate permission. Owners, admins, and auditors all have it — generating and downloading evidence is the one write-shaped thing an auditor's otherwise read-only role can do, by design.

Steps: generating a pack

  1. Go to Evidence.
  2. Choose the scope — the case, product, or time range the pack should cover.
  3. Generate the pack. You get a document plus a verification code, printed under its title on the first page and again in its Integrity section.
  4. Download it and share it with whoever needs it — a regulator, an internal reviewer, or your own auditor.

Steps: verifying a pack independently

Anyone holding the pack — not just someone signed into your workspace — can check that it's genuine:

  1. Go to the public /verify page. No sign-in required.
  2. Enter the verification code. It is under the pack's title on the first page, and again in its Integrity section.
  3. Declara confirms when the pack was issued, what it covers, and how much of the audit chain sits behind it — without showing any of the pack's actual contents.

What you should see

A verified pack shows its chain as intact. Contents are never displayed on the verify page itself; the check only confirms the pack is genuine, not what's in it.

What a broken chain means

Every workspace's audit log has database-level grants that revoke UPDATE and DELETE on the audit table — the chain is tamper-evident, not tamper-proof. A pack whose chain fails verification is not something to troubleshoot yourself; treat it as a support escalation.

Related