That default is broken. Reports should be signed and verifiable.
The problem with a normal report
A PDF is just a file. Anyone can generate one, edit one, or backdate one. The signature on the final page is usually an image file pasted onto the canvas. When an organization certifies that personal data is handled lawfully, the inability to verify that certificate is a material defect.
What we do instead
When a report is issued, three controls execute:
- It is signed. The PDF carries a PAdES signature. Any change to the file after issuance is immediately detectable. The cryptographic signature proves the document has not been altered.
- It is registered. A record of the report (its ID, signature, cryptographic hashes, and lifecycle status) is written to a registry. The registry confirms the report was issued under an active subscription and remains valid.
- A proof block is embedded. The document carries a manifest digest and a Merkle root calculated over the engagement's append-only audit trail. The finding is anchored directly to the record of how it was produced.
Anyone (a client, a regulator, or a commercial counterparty) can check the document against the registry at /verify. The registry returns one of four definitive states: Authentic, Invalid, Revoked, or Superseded.
Why two mechanisms, not one
A signature answers one question: has this document changed? It cannot tell you whether the document was legitimately issued or whether it remains valid today. The registry answers the lifecycle question.
Neither mechanism works in isolation:
- A valid signature over a forged document proves only that the forgery has not been modified since signing.
- A registry entry without a cryptographic signature cannot prove that the specific file in your hands matches the record in the registry.
Together, they close both failure modes. The registry does not store the report body or the underlying evidence. Verification confirms status while confidential audit records remain protected.
What this means for an auditor
- The report travels with its own proof. You do not need to ask clients to take your word on trust. You hand them an artifact they can independently verify.
- Tampering is detectable, not just discouraged. Altering a single digit in the report flips the verification result to Invalid.
- Revocation is enforceable. A report issued under a lapsed subscription can be marked Superseded, and the verification interface reflects that status immediately.
A compliance claim should be checkable by the person receiving it. Anything less is merely a promise.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Not legal advice, not a certification scheme. www.dpdpdone.com/verify