Every audit report we issue carries a SHA-256 hash, which is a short string of characters calculated from the exact bytes of the finished document. This page publishes those hashes so that anyone holding a copy can check the copy against the version we actually issued.
An audit that nobody can check is only an assertion. A city that publishes one of our reports should be able to point the public at something better than our word, and so should any resident who wants to confirm the copy in their hands, and that is the entire purpose of this page.
First confirm that your address bar reads civicattest.com exactly. A page that copies this layout on some other address proves nothing at all, and checking costs you a moment.
Then choose the report you were given, and your browser calculates its fingerprint on this computer and compares it to the registry. The file is never uploaded and never leaves your machine.
On a phone, if the report came to you as an email attachment, open the email, tap the PDF, tap the share button, and choose Save to Files. Then come back here, tap the button above, and pick the file you just saved. If the report is already in your Files app or Downloads, tap the button and go straight to it.
A hash is a one way calculation. Changing a single character anywhere in a report produces an entirely different hash, so any alteration to the document becomes visible the moment the two strings are compared. Adding a page, deleting a finding, or editing a single date will all fail the comparison.
The calculation cannot be run backward: nobody can take a hash from this page and reconstruct the report it came from, because the hash carries none of the original content with it, so these strings are fingerprints rather than copies.
Nothing on this page identifies any client. There are no city names, no department names, no findings, no counts, and no line of log data on this page or inside the hashes themselves. Each registry entry records only that a document exists and what its fingerprint is.
Every report carries a findings hash, printed on its cover. It is calculated from the findings themselves rather than from the file. The sealed and the public version of one audit carry the same findings hash, and that is how a council can confirm the public copy reflects the same review the chief received.
The registry below also publishes a document hash for each file we issue. That one is the fingerprint of the exact PDF, and it is what the commands further down will give you. It proves your copy of that file has not been altered.
| Audit registry number | Issued | Engine | Hashes |
|---|---|---|---|
| SAMPLE-2026-0001 | 2026-09-05 | r4.2 |
Findings, both versions 5de251eae48879b3bdb200a655a736a6731cdb817dd143ea53db89195af2f8aa Document, public version ce32bfd788998fbe141e872ab213f75fe46ca6930dd64cf21a30f10ecf205845 Document, sealed version 0084e0e0ba46a0fcfaca9d6f94f63a87d4b635cf7b7fe4a1b72ca7403bdf70c3 |
A failed comparison does not by itself mean that anyone acted improperly. A file can change through an ordinary re-save, a printing step, or an email system that rewrites attachments. The comparison tells you only that the copy in front of you is no longer the document we issued, which is exactly the question worth asking.
A certified report can only be as trustworthy as the file behind it, so every engagement opens with a request for the agency's complete audit export, and we name four things in that request: complete time coverage with no gaps across the period under review, every deletion event the system recorded, unmodified native files exactly as the system generated them, and all log types the system produces. When the export meets that standard, our report can attest to the completeness of the file we received, which is the foundation that everything else on this page rests on.
Learn more about complete exports.
You do not have to trust the checker at the top of this page, and you should not have to, because it runs our code. Anyone who wants an answer that does not depend on us at all can compute the same fingerprint with a tool that ships with their own operating system, using whichever line below matches their computer, and compare it to the registry by eye.
On Windows, open Command Prompt and run this line:
Both lines together, exactly as written. They assume the file is in your Downloads folder and is still named as it was issued. If you renamed it or saved it elsewhere, change the file name on the second line to match.
On macOS, open Terminal and run this line:
On macOS you can type the command, then drag the PDF onto the Terminal window to insert its path.
On Linux, open a terminal and run this line:
Compare the result against the document hash for that version in the registry row carrying the audit registry number. Matching in every position means the copy is byte for byte the document we issued.