Verify a record.
Independent, client-side cryptographic verification. The record is processed locally and is not sent by this verifier. Paste a supported record, upload a JSON file, or open a verification link — a Glacis permalink keeps the record in the URL fragment, which browsers do not send to a server or include in the page-view telemetry used on consent.
The link carries the receipt after the #. Fragments are never sent to a
web server, so pasting one into a ticket or an email does not hand the receipt to us,
to your CDN, or to anyone’s access log. Whoever opens it verifies it in their own browser.
Reviewing a vendor? Require receipts. Verify the record.
You just checked someone else’s claim in your own browser, with no account and no trust in us. That is the whole point: the party making the claim should not be the only party who can check it. Ask every AI vendor for the same thing, and make your own operational records checkable.
For AI buyers
A receipt preserves signed, covered claims that identify a reported event and reported event time. Supported checks can make later changes to covered bytes detectable, but do not establish that the event occurred or when. It is not a verdict on whether the system behaved well. The OVERT standard sets out which fields are signed and how a verifier checks them. Four questions get you most of the way through a vendor review:
- Is there a receipt per covered event, or a document about events? A policy PDF describes intent. A receipt preserves what the configured path reported for a covered event; it does not establish that the report is true or complete.
- Who countersigned it? Identify who controls each key, how it was authorized, and the organizational relationship among operator, signer, witness, and reviewer. A countersignature adds a separately checkable claim; it does not by itself establish organizational independence.
- What do the signed bytes actually cover? Fields outside the signature can be edited without breaking it. Ask for the list; this page prints it for every receipt it checks.
- Can you check it yourself? Ask whether a supported verifier can check the record with disclosed trust material without a vendor account or live API call. That is independent verification of the artifact, not proof that the signer or witness is organizationally independent.