Attestkeep
Sign up
Evidence and audit

A signed period report your auditor checks without us.

Create an account Verifying a report
<report-id>.attestkeep.zip report.json The evidence, byte for byte as signed check this attestation.json DSSE envelope naming the report's digest certificate.jwt Attestkeep vouches for the signing key <report-id>.pdf A rendering for people to read
Also inside: README.txt, and the same three artefacts in one file for the verify page.
What it does

Evidence packages

Pick a framework and a period. Attestkeep maps the cluster's own records to that framework's clauses and marks each one met, partial, gap or outside scope, with the numbers behind it and the report sections they come from.

The report is signed inside the cluster with the installation's key, and the licence certificate ties that key to your installation. It is evidence from your own records, not a certification.

How it works

Step by step.

  1. Choose a framework and a period

    In the console's evidence screen.

  2. The report is assembled

    From the ledger, the scans and the triage decisions.

  3. It is signed

    DSSE over an in-toto statement, with the installation's key.

  4. Download the zip

    Report, attestation, certificate, PDF and README.

  5. Your auditor verifies it

    In the browser at attestkeep.com/verify.html, or with a short script.

What it records

Generating, downloading and marking a package delivered are each an audit log entry.

Verifying a reportCompliance frameworks

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account