Compliance Evidence Export

When a regulator, auditor, or compliance reviewer requests proof that your AI system made a specific decision — and that the record has not been altered — you export a compliance evidence package. This package includes the session record, its Merkle proof, and the on-chain anchor, all in a format the reviewer can independently verify.

What a compliance evidence package contains

The package is tamper-evident: if any field in the session record has been modified since anchoring, the hash comparison in the verification report will fail.

Exporting from the Customer Portal

Compliance workspace exports

For audit hand-offs from the Compliance workspace:

1. Open Compliance in the left sidebar.
2. Select the Evidence Exports tab.
3. Choose either a GDPR Data Subject or an Auditor Access Link.
4. Use Download Evidence Pack (PDF), Export as ZIP, or Export Auditor Evidence (ZIP) depending on the package you need.

Programmatic export via API

Export a single session’s evidence bundle from the Customer Portal API:

import httpx
 
# Authenticate with your portal session token or customer API key
headers = {
    "Authorization": "Bearer your-portal-jwt",
    "X-API-Key": "your-secondary-api-key",
}
 
# Export JSON bundle for a specific session
response = httpx.get(
  "https://my.veriproof.app/v1/sessions/loan_0042/evidence",
    params={"format": "json"},
    headers=headers,
)
evidence = response.json()
 
# Save to disk
with open("evidence_loan_0042.json", "w") as f:
    import json
    json.dump(evidence, f, indent=2)

const response = await fetch(
  'https://my.veriproof.app/v1/sessions/loan_0042/evidence?format=json',
  {
    headers: {
      'Authorization': 'Bearer your-portal-jwt',
      'X-API-Key': 'your-secondary-api-key',
    },
  }
);
 
const evidence = await response.json();

curl -s \
  -H "Authorization: Bearer your-portal-jwt" \
  -H "X-API-Key: your-secondary-api-key" \
  "https://my.veriproof.app/v1/sessions/loan_0042/evidence?format=json" \
  | jq '.'

Verifying the evidence independently

Reviewers who want to independently verify the package (without relying on VeriProof) can check three things:

Step 1 — Recompute the session hash

from veriproof import compute_merkle_root_hex
 
with open("evidence_loan_0042.json") as f:
    evidence = json.load(f)
 
# Recompute from the raw session record
session_record = evidence["session_record"]
computed_leaf_hash = compute_merkle_root_hex([session_record])
expected_leaf_hash = evidence["merkle_proof"]["leaf_hash"]
 
assert computed_leaf_hash == expected_leaf_hash, "Session record was tampered"
print("Session hash matches:", computed_leaf_hash)

Step 2 — Verify the Merkle proof

from veriproof import verify_proof
 
proof_valid = verify_proof(
    leaf_hash=evidence["merkle_proof"]["leaf_hash"],
    proof_path=evidence["merkle_proof"]["path"],
    root=evidence["merkle_proof"]["root"],
)
assert proof_valid, "Merkle proof invalid: session not in this batch"
print("Merkle proof valid")

Step 3 — Confirm the root on-chain

Look up the Solana transaction ID from evidence["anchor"]["transaction_id"] on Solana Explorer  or the Solana FM block explorer . The transaction data contains the Merkle root hash. Confirm it matches evidence["merkle_proof"]["root"].

Retention and availability

On-chain anchors on Solana are permanent and publicly accessible from the transaction ID regardless of your VeriProof plan or subscription status.

Regulatory format notes

EU AI Act / GDPR: The JSON bundle contains the required transparency fields (model identity, decision basis, human oversight type) as defined in the governance annotation vocabulary.

US financial regulators (OCC, CFPB model risk): The PDF report is formatted to satisfy the documentation requirements in SR 11-7. Include the PDF and the JSON bundle for complete audit capability.

ISO 42001 (AI Management Systems): Bulk exports can be generated per audit period and stored in your document management system alongside other ISO 42001 evidence.

Next steps

• Blockchain Verification — detailed independent verification walkthrough
• Compliance Monitoring — set up ongoing monitoring dashboards
• Governance Scoring — understand how governance scores appear in evidence packages