Bundle verification

Verify an evidence bundle.

Paste the SHA-256 digest printed on the cover sheet of a bundle, or scan the QR on the page with your phone camera and you will land here directly. We will confirm whether the bundle was issued by us — without revealing any case detail beyond the URN.

How verification works

Three steps, no special tooling.

Every evidence bundle we issue carries a deterministic SHA-256 fingerprint, a scannable QR, and a public lookup. Together they let anyone — counsel, journalist, regulator — confirm the document is real, untampered, and ours.

  1. STEP 01
    Bundle is fingerprinted

    When we export an evidence pack, we hash every file + the manifest into a single 64-character SHA-256 digest. The same digest is printed on the cover sheet and stamped into MANIFEST.txt.

  2. STEP 02
    You scan the QR or paste the digest

    Any phone camera reads the QR on the cover sheet and lands here. No app, no account. The 64-character digest can also be pasted manually into the box above.

  3. STEP 03
    We confirm it against our records

    If the digest matches a bundle we issued, we return its URN, issue date and file count. Nothing else — no narrative, no contact, no PII. If it does not match, the bundle is forged or tampered with.

Verification is a public service. It deliberately reveals no personal information — only that a bundle with the given digest was, or was not, issued by us. The full chain-of-custody trail lives inside the platform's hash-chained audit log, available to tenants and auditors on request.

Anticorruption Gateway
ANTICORRUPTION GATEWAY

A confidential reporting service operated under POPIA. Reports are anonymous by design and all data is encrypted.

All communications on this website are encrypted in transit (TLS 1.3) using an SSL certificate issued by Google Trust Services.

Secured by
Google Trust Services
Compliance
  • POPIA — Act 4 of 2013
  • Protected Disclosures Act — 26 of 2000
  • ISO/IEC 27001 · ISO 37001 aligned
  • Companies Act — 71 of 2008
  • TLS 1.3 in transit · AES at rest
  • EXIF / GPS metadata stripped on upload
  • IP addresses never recorded
Johannesburg · Firebase verified

Your report stays on South-African soil. The server refuses to boot from any other region.

© 2026 Anticorruption GatewayForensic Standard · Multi-Tenant Isolated