Public verification

Verify an evidence pack

Every ZeroRecall audit ships as a signed .pack.json. Anyone can check it here. Four things are recomputed: the SHA-256 hash chain, the manifest hash, the ECDSA (P-256) signature, and whether that signature was made with our published key. All four run in your browser with WebCrypto. The file is never uploaded and never reaches us.

Want to try it? Download a sample pack. Two are offered on purpose, both signed packs from real audits of our mock demo environment: a verified case (FORGET 100) where the deletion held, and a failing case (FORGET 0, leaks present) where it did not. Both verify as untampered: the signature seals what the audit found, including a bad result. You can also open any case in the console and grab its pack. Our signing key is published at /.well-known/zerorecall-signing-key.pem so you can pin it and check the fourth line yourself. The full format, the exact canonicalization rule and a working verifier that uses none of our code are on the pack spec page. The fourth line matters more than it looks: a valid signature only says that someone signed the file. Anyone can generate a key and sign anything. Verification proves audit-log integrity; it is not a guarantee of permanent removal from model weights, and it does not yet prove when the file was made.

If a pack carries a supersedes field, it is replacing an earlier audit and names that one by hash, inside the signature. The rule for when we may do that, and what the rule cannot enforce, is written out in the archive policy.