Your file never leaves this browser

Verify Without Trusting Us

Your assessors, primes, and auditors can check any CPCSC evidence receipt independently. No login required. No trust necessary. Just mathematics.

1. Verify Your Receipt

Enter an event ID to retrieve the cryptographic receipt from your evidence submission.

Retrieve Receipt

2. Verify Original File Integrity

Zero-Knowledge Verification

Your file never leaves this browser. SHA-256 hash is computed locally and compared against the cryptographic receipt. No data is transmitted to our servers.

📎

Drag and drop your file

Or click below to browse

How It Works

Three pieces of information you need to understand

🔐

What Gets Signed

When you submit evidence to Solymus, we compute the SHA-256 hash of the file. This 32-byte hash is signed by AWS KMS using ECDSA P-256, the same algorithm used by governments and financial institutions worldwide. The signing key never leaves the HSM.

Who Can Verify

Third parties—auditors, assessors, or prime contractors—can verify any receipt without logging in. The public verification API exposes only the cryptographic proof: signature, algorithm, and Merkle chain linkage. No secrets. No audit logs. Pure mathematics.

📦

What You Export

When you export evidence, Solymus bundles the receipts into a JSON manifest with per-artifact verification URLs. Each URL points to this page with the event ID pre-filled. Assessors can verify offline or share verification URLs in their compliance reports.

The Mathematics

We don't ask you to trust us. We ask you to trust mathematics.

The cryptographic primitives that secure CPCSC evidence are battle-tested in military, financial, and governmental systems.

SHA-256 (NIST FIPS 180-4) — 32-byte cryptographic hash
ECDSA P-256 (NIST FIPS 186-4) — elliptic curve digital signature
AWS KMS FIPS 140-3 Level 3 — hardware-rooted key management
RFC 8785 — JSON canonicalization for deterministic serialization