Evidence

How Checkbox stores what it observed in a tamper-evident, hash-chained and signed evidence vault, and how to list, download and verify it.

Every observation behind a finding — a checkout screenshot and its HTML, an email, a billing-platform setting, a consent record, an evaluation — is stored as an evidence record. Findings reference the evidence they rest on, so you can show exactly what a subscriber saw and when.

#How it is protected

• Content-addressed. Each record's content is stored under its SHA-256 hash.
• Hash-chained per site. Each record includes the hash of the previous one, so removing or changing any record breaks the chain.
• Signed anchors. Chain heads are signed and anchored periodically; production storage uses S3 Object Lock, so records cannot be altered or deleted during the retention period.
• Verifiable by anyone. Evidence exports include a standalone verifier.

#List, download and verify

curl -G https://app.checkbox.site/v1/evidence \
  -u "$CHECKBOX_SECRET_KEY:" \
  -d site=site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b \
  -d limit=5

import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const evidence = await checkbox.evidence.list({ site: 'site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b', limit: 5 });
for (const record of evidence.data) console.log(record.id, record.kind, record.stored);

import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

evidence = checkbox.evidence.list(site="site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b", limit=5)
for record in evidence.data:
    print(record["id"], record["kind"], record["stored"])

Verify a site's whole chain:

curl https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/evidence/verify \
  -u "$CHECKBOX_SECRET_KEY:" \
  -H "Content-Type: application/json" \
  -d '{}'

import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const result = await checkbox.evidence.verifyChain('site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b');
console.log(result);

import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

result = checkbox.evidence.verify_chain("site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b")
print(result)

Download a record's content with downloadEvidenceContent (GET /v1/evidence/{evidence}/content). See the Evidence API.

#Monitoring certificates

A site with continuous monitoring can be issued a signed monitoring certificate with a public verification page and a badge (createCertificate). A certificate states what was monitored and when; it is not insurance and not a statement that the business complies with the law. It lapses when monitoring stops being fresh or the site's URL changes.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.