For banks, auditors and regulators

Verify a piece of evidence

A company sent you an evidence file with a StackWeaver Evidence Object ID (it looks like EO-2026-000184). Check that StackWeaver recorded exactly that file, and whether it is still the current version. Your file is fingerprinted in your browser and is never uploaded.

Printed on the evidence, in the package's manifest, or in the email that came with it.

2. The file, or its SHA-256 fingerprint

Questions

What does a match prove?

That StackWeaver recorded a file with exactly this SHA-256 fingerprint under this Evidence Object ID, when it was recorded, and whether it is still the current version. It does not say whether the evidence is enough for your purpose: that judgement stays with you, the reviewer or the auditor.

Does my file get uploaded?

No. Your browser computes the SHA-256 fingerprint of the file locally. Only the Evidence Object ID and the 64-character fingerprint are sent. The file never leaves your device.

Why might a genuine file not match?

Any change to the file, even re-saving it or exporting it again, changes its fingerprint. Ask the company for the exact file they submitted, or for a StackWeaver evidence package, which carries every file together with its fingerprint.

What does the verification reveal about the company?

Nothing beyond the answer to your question. It does not return the company name, the title of the evidence or its content, and an unknown ID gets the same answer as a wrong fingerprint.

Checking a whole StackWeaver evidence package? Its manifest lists the fingerprint of every file, and signed packages can be checked against StackWeaver's published public keys atportal.stackweaver.cloud/api/oef/keys.