The whole observation
Screenshot, HTML, visible text, response headers, redirect chain and the browser profile that produced them, captured together rather than as a folder of unrelated files.
Website evidence
Proof of what your website said, checkable by anyone
Auditwolf records the page, hashes every artifact, seals the audit with a signature and an independent timestamp, and hands you a bundle that somebody outside your company can verify without an account and without trusting us.
Create a free accountRead the API docs
- SHA-256 per artifact
- Ed25519 signed
- RFC 3161 timestamped
- Verifiable without an account
Evidence bundleaudit-aw-2841.zip
VERIFIED- Artifact hashes
- VALID
- Merkle membership
- VALID
- Auditwolf signature
- VALID
- Trusted timestamp
- VALID
Checked by the public verifier no account
The problem
A screenshot proves nothing on its own
The usual record is a screenshot in a folder, or a PDF in a ticket. Both are trivially editable, neither says when it was taken by anything other than a file date, and when somebody eventually disputes what a page said, the answer is your word against theirs.
Auditwolf seals the observation instead. Every artifact is hashed, the audit is signed, and an independent authority timestamps the root. The person checking it recomputes the whole chain from the bundle rather than asking our database whether the record is genuine.
POST /auditwolf/verify/v1/bundles
Content-Type: multipart/form-data
bundle=@audit-aw-2841.zip
200 {
"valid": true,
"artifact_hashes": "valid",
"merkle_membership": "valid",
"signature": "valid",
"timestamp": "valid",
"key_id": "aw_ed25519_8a13c09e"
}Capabilities
What makes the record hold up
Each layer answers a different challenge: what was captured, that it has not changed, when it existed, and who can check it.
Hashed and sealed
Every artifact carries a SHA-256. Page evidence joins an audit Merkle tree, and the root is signed with Ed25519, so changing one byte invalidates the record.
Independently timestamped
An RFC 3161 authority certifies when the root existed. Only the digest is sent, so the authority learns nothing about your site and cannot be asked to reissue it later.
Checkable by anyone
A public verifier recalculates the hashes, rebuilds the Merkle path and checks the signature against a published key ledger. No account, and no need to trust our database.
A history that follows the page
Observations are tied to the logical page, so a record survives a URL move and you can compare what the same page said on two dates.
Custody you control
Export bundles to your own S3-compatible storage with sealed credentials, each object written with its hash so your copy verifies like the original.
Use cases
When somebody asks what the page said
Anywhere the answer needs to be checkable by a person who has no reason to trust you.
Regulated wording
Keep a checkable record of the risk warnings, disclosures and terms that were live on a date.
Advertising and claims
Record what a campaign page said while it ran, rather than reconstructing it from a content system afterwards.
Disputes and complaints
Answer "what did the page say on the 12th" with a record the other side can verify without taking your word for it.
Supplier and partner pages
Observe pages you do not control and keep proof of what they published.
Change records for auditors
Hand over a bundle and a verifier rather than a screenshot in a document nobody can check.
Internal sign-off
Attach the observation to the approval, so the record and the decision live together.
Check a bundle yourself
The verifier is public and takes no account. There is also a strict offline command-line verifier if you would rather not upload evidence to check it.
Open the verifierPricing
One credit per successful page capture
Evidence integrity is identical on every plan, including the free one. You are charged when a capture completes, infrastructure failures on our side cost nothing, and there are no overage charges on any plan. Plans differ in volume, sites and how long we host the evidence for you.
Questions
Before you integrate
The details that decide whether this fits, without reading the whole reference first.
What is actually in an evidence bundle?
The full-page screenshot, the HTML, the visible text, the response headers, the redirect chain and the recorded browser profile for each page, with a SHA-256 for every artifact, the audit Merkle root, the signature and the timestamp token.
How can somebody outside my company check it?
They upload the bundle to the public verifier. It recalculates the artifact hashes, rebuilds the Merkle path, checks the signature against the published key ledger and validates the timestamp. No Auditwolf account is needed to do that.
What stops you altering a record after the fact?
The signature covers the Merkle root, and the root changes if any artifact changes. The timestamp is issued by an independent authority over that root, so a later edit cannot be backdated. Verification does not ask our database whether a record is valid; it recomputes it.
Does the timestamp authority see my pages?
No. Only a SHA-256 imprint is sent for timestamping. The authority certifies when that digest existed and learns nothing about the site it came from.
Can I keep the evidence somewhere I control?
Yes. Export bundles to your own S3-compatible storage. Your credentials are sealed in a vault, and each object is written with its SHA-256 so the copy in your bucket verifies exactly as the original does.
Is this a legal certification that my site was compliant?
No. Auditwolf records what its controlled browser observed and whether the rules you configured passed, and it makes that record independently checkable. It does not provide a legal opinion or certify compliance with any regulation.
What does capturing evidence cost?
One credit per successful page capture. Infrastructure failures on our side cost nothing, and there are no overage charges on any plan.
Capture your first sealed record
Create an account, add a site and run an audit. The evidence chain is the same on the free plan as on every paid one.
Evidence integrity is identical on every plan, with no overage charges and no card required to start.