QorTrace
Docs

How to embed badges, share verification links, and validate a third-party audit.

Every QorTrace audit is publicly verifiable. Here's how to use that.

Sharing your own audit

Public verify URL

Send anyone the link /verify/<audit_id>. They'll see the audit summary, methodology version, and a "Tamper-evident PDF" indicator. Your source code is never disclosed through this surface.

Embed a badge

Drop one of these in your README:

MARKDOWN
[![QorTrace Audited](https://qortrace.com/api/audits/<id>/badge.svg?style=pill)](https://qortrace.com/verify/<id>)

Style options: pill, card, watermarked-pill. The SVG re-renders on every request so the metadata always reflects the latest published version of the audit.

LinkedIn / Twitter / X

The verify URL has Open Graph + Twitter Card metadata baked in. Paste the link, you'll get a rich preview with the verdict and methodology version.

Verifying someone else's audit

Got a vendor / counterparty waving an audit certificate around? Verify it in 10 seconds.

  1. Visit /verify and paste the audit ID (or the full URL).
  2. Or upload their PDF — we hash it and confirm the signature against our signing key.
  3. You'll see:
    • Methodology version (look for v0.2 or later)
    • Auditor identity (Standard = QorTrace AI; Deep Dive = the senior auditor + peer reviewer)
    • Severity summary
    • Date issued + last verified

What "tamper-evident" actually means

Every audit PDF is signed with our internal Ed25519 audit-signing key. The signature covers the entire body — change a single byte and the verification fails. Our public key is published at /security and rotated annually with a publicly logged transition window.

For compliance reviewers

Hit /methodology/receipt/<audit_id> for a stamped, downloadable PDF receipt that maps the audit findings to:

  • NIST FIPS 203 / 204 / 205
  • NSA CNSA 2.0
  • ISO 27001
  • SOC 2 (Trust Services Criteria)
  • EU DORA
  • FFIEC

The receipt is signed and includes a checksum reviewers can paste into their workpapers.