# Evidence

> How Checkbox stores what it observed in a tamper-evident, hash-chained and signed evidence vault, and how to list, download and verify it.

Every observation behind a finding — a checkout screenshot and its HTML, an email, a billing-platform setting, a
consent record, an evaluation — is stored as an **evidence** record. Findings reference the evidence they rest on, so
you can show exactly what a subscriber saw and when.

## How it is protected {#integrity}

- **Content-addressed.** Each record's content is stored under its SHA-256 hash.
- **Hash-chained per site.** Each record includes the hash of the previous one, so removing or changing any record
  breaks the chain.
- **Signed anchors.** Chain heads are signed and anchored periodically; production storage uses S3 Object Lock, so
  records cannot be altered or deleted during the retention period.
- **Verifiable by anyone.** Evidence exports include a standalone verifier.

## List, download and verify {#api}

```curl
curl -G https://app.checkbox.site/v1/evidence \
  -u "$CHECKBOX_SECRET_KEY:" \
  -d site=site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b \
  -d limit=5
```
```node
import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const evidence = await checkbox.evidence.list({ site: 'site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b', limit: 5 });
for (const record of evidence.data) console.log(record.id, record.kind, record.stored);
```
```python
import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

evidence = checkbox.evidence.list(site="site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b", limit=5)
for record in evidence.data:
    print(record["id"], record["kind"], record["stored"])
```

Verify a site's whole chain:

```curl
curl https://app.checkbox.site/v1/sites/site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b/evidence/verify \
  -u "$CHECKBOX_SECRET_KEY:" \
  -H "Content-Type: application/json" \
  -d '{}'
```
```node
import Checkbox from '@checkbox-site/cli';

const checkbox = new Checkbox(process.env.CHECKBOX_SECRET_KEY);

const result = await checkbox.evidence.verifyChain('site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b');
console.log(result);
```
```python
import os
from checkbox import Checkbox

checkbox = Checkbox(os.environ["CHECKBOX_SECRET_KEY"])

result = checkbox.evidence.verify_chain("site_3f9a1c2e7b4d4e0f9a8b7c6d5e4f3a2b")
print(result)
```

Download a record's content with `downloadEvidenceContent` (`GET /v1/evidence/{evidence}/content`). See the
[Evidence API](https://checkbox.site/docs/api/evidence).

## Monitoring certificates {#certificates}

A site with continuous monitoring can be issued a signed **monitoring certificate** with a public verification page
and a badge (`createCertificate`). A certificate states what was monitored and when; it is not insurance and not a
statement that the business complies with the law. It lapses when monitoring stops being fresh or the site's URL
changes.