Evidence auditors can verify without trusting your box

The self-hosted evidence problem

Every compliance tool has to answer one question at audit time: did the evidence in the report exist on the date the report says it did? SaaS compliance products answer it with the vendor's reputation — trust that Vanta's or Drata's clock and database are honest. Self-hosted products can't use that answer. The customer runs the database. The customer runs the clock. Nothing stops a determined auditee from backdating an attestation, or from replacing an evidence file with a different one after the fact.

Silence isn't an option: an auditor who notices the gap is right to discount the tool's output. Every meaningful piece of evidence in Controls is therefore anchored to an external cryptographic timestamp before it counts as sealed.

What Controls anchors to an external authority

How an auditor verifies it offline

Controls' audit-package export bundles every timestamp token alongside the exact document that was hashed. Auditors run standard OpenSSL against those files. No Scorifya account, no proprietary tooling, no network calls to us. The DigiCert and Sectigo root certificates are already in every modern Linux and macOS trust store; they are not our authorities.

A representative verification for a check run:

# From within the unzipped audit-package directory
cat runs/index.json | jq '.runs[] | select(.runId=="<run-id>")'
curl -O <tsaCaCertUrl from the JSON>

openssl ts -verify \
  -data runs/<run-id>.json \
  -in   runs/<run-id>.tsr \
  -CAfile <ca-cert filename>

# Expected: "Verification: OK"

"Verification: OK" means the timestamp authority — independent of the customer and of Scorifya — confirmed the exact per-check result set existed at the shown time and has not changed since. The same pattern applies to attestations, adopted policies, and direct evidence-file hash checks.

What the anchor model does NOT prove

• ·That checks weren't re-run. A timestamp proves what was true at run time, not that the customer didn't re-run a failing check ten times until it passed. Auditors reviewing the run history in the audit package see every anchored run, so a suspicious pattern of "run at 4:59 PM, run again at 5:01 PM" is visible.
• ·That the underlying cloud state was accurate. Controls records what the AWS, GCP, Azure, and GitHub APIs returned when the check ran. Auditors independently verify a sample of material findings against the source systems.
• ·That the operator is honest about what evidence exists. A missing attestation is a missing attestation. The model proves the ones that exist are real; auditors verify coverage independently.
• ·That evidence file content is meaningful. The hash proves the bytes have not changed since attestation. It does not prove that the PDF actually documents what its filename claims. That is what auditors do.