DoveSureSign inUse your InvitationSign in

Verify

Don’t Trust Us. Check Us.

A compliance badge asks you to believe a vendor. A DoveSure record can be checked: its history is hash-chained, its checkpoints are signed, and those signatures are timestamped by someone else. Anyone can verify all of it, with no account and no permission.

Check a Trust Center now

Verify a Published Record

Enter the address of any DoveSure Trust Center that publishes its proof. Your browser fetches the checkpoint and the key, and checks the signature here, on your machine.

What is being checked

Four Things, None of Them Our Word

  1. Take the signed checkpoint

    A Trust Center that publishes its proof serves the latest checkpoint of its record: how many entries it covers, the Merkle root over them, the head of the hash chain, and the exact statement that was signed.

  2. Check the signature

    Verify the Ed25519 signature over that statement with the published key. The key is served separately, so you never have to take it from the same place as the claim. If any entry in the history had been changed, the root would differ and this would fail.

  3. Check the timestamp

    The checkpoint is submitted to an independent RFC 3161 timestamp authority in a batch. The token, and the proof that the checkpoint sits inside the batch the authority stamped, show it existed by that time. It cannot be back-dated afterwards.

  4. Check an export, if you have one

    An audit export carries the evidence with its hashes, the ledger entries, inclusion proofs and a signed manifest. The standalone verifier re-checks every file, the chain and the proofs offline, with no dependencies and no connection to DoveSure.

Hash-chained history

Every material change is chained to the one before it. Rewriting one entry breaks every entry after it.

Signed checkpoints

Signed with a key held outside the database, so a database dump alone cannot forge one.

Independent timestamps

An RFC 3161 authority attests when a checkpoint existed. DoveSure cannot move that time.

Offline verifier

A single file with no dependencies re-checks an export end to end, without contacting DoveSure.

Corrections are not hidden by any of this. Evidence can be superseded, findings closed, exceptions approved with a reason and an expiry. What cannot happen is a record quietly disappearing, which is exactly what an auditor needs to know. How the record is protected

Proof, not screenshots

If you are evaluating DoveSure, ask us for a Trust Center address and check it yourself before you talk to anyone.

Use your Invitation