Verifying an audit certificate

Every QorTrace audit is publicly verifiable without revealing your source code. Here's how.

For your customers / partners

Send them either:

• The verify URL: https://qortrace.com/verify/<audit_id>
• The audit ID alone — they can paste it at /verify

They'll see:

• Subject — what was audited (contract name + chain)
• Tier — Standard / Deep Dive
• Methodology version — qortrace-method-v0.2 or later
• Verdict — Pass / Pass with caveats / Fail
• Severity counts — Critical / High / Medium / Low
• Signed PDF link — they can download and re-verify
• Last verified — anyone can hit the page; we log anonymised view counts

They will not see:

• Your source code
• Your repo URL
• Your account email
• The full text of any finding (only severity counts)

For compliance reviewers (SOC 2, ISO 27001, DORA)

Generate a methodology receipt PDF:

It includes:

• Audit metadata (subject, tier, date, version)
• Methodology version cited section-by-section
• Compliance alignment statements (FIPS 203/204/205, CNSA 2.0, DORA, etc.)
• A hash chain — every receipt links to the next, so reviewers can confirm none have been omitted
• A signature they can verify against our public Ed25519 audit-signing key (published at /security)

For everyone — verifying a PDF you've been handed

Got a QorTrace PDF from a third party and want to confirm it wasn't tampered with?

1. Visit /verify
2. Drag-and-drop the PDF
3. We hash it and check the signature against the original audit_id on file

Common results:

• ✅ Verified — PDF matches what we issued.
• ⚠️ Modified — PDF differs from what we issued (e.g. someone added a watermark or stripped a page). The audit IS still genuine, but they've edited the artefact.
• ❌ Unknown — we have no record of this audit. Either the ID is wrong or it's a forgery.

Public registry

Every audit is queryable at /api/public/audits/{id} (no auth needed) — useful for building your own verification UIs. The response is the same data as the verify page in JSON form.

Revocation (rare)

In the unlikely event we revoke an audit (e.g. a supplied source was misrepresented), the verify page shows a ❌ Revoked banner with the reason. The PDF signature still verifies (PDFs are immutable) but the audit's standing is publicly null. We've revoked exactly 0 audits as of writing.

Bulk verification

For procurement teams that need to verify dozens of vendor audits, hit /api/public/audits/bulk-verify with a JSON array of IDs. You get a single response with all verdicts. No auth required.