What is an evidence pack?

A dated record of what a page said before and after it changed, put together so someone else can check it: two readings with their times and fingerprints, the word-for-word difference, the dated copies, and a third-party timestamp.

Why is a screenshot not enough?

A screenshot shows what somebody says a page said, and you have only their word for when it was taken. Nothing in the image ties it to a time that a neutral party will vouch for.

What is an RFC 3161 timestamp?

A signed token from a timestamp authority saying a given fingerprint existed at a given moment. Each time we read the pages we watch, the list of readings gets one, so the time doesn't rest on our own clock.

Does an evidence pack prove the vendor changed the page on a particular date?

No. It proves the page said one thing at the first reading and another at the second. The change happened between them, and the pack gives both times instead of picking one.

Why does the pack include the raw difference and not just the finding?

A line moved is what the page did. A fact moved is what we made of it. Showing only the second asks you to trust our reading, and the pack has to stand up if someone disagrees with it.

Free template · Evidence pack

What did that vendor page say in March? Can you prove it?

A customer, an auditor or a lawyer asks. A screenshot won't settle it: they have only your word for when it was taken.

Here's what an evidence pack has to carry, with a real one.

The time comes from someone else.

A reading becomes evidence when someone with no stake in the answer vouches for when it was taken. Each page gets a fingerprint (SHA-256 hash) that changes if a single character does.

List
Each time we read the pages we watch, every page's fingerprint and address goes into one list, the manifest.
Sign
The manifest's own fingerprint goes to a timestamp authority, which signs it under RFC 3161.
Check
The token proves the manifest existed then. The manifest proves which fingerprints were in it. The fingerprints prove the content.

Eight sections, in this order.

What it is, then the two readings, then the raw difference, and only then our reading of it.

1. What is being evidenced
The vendor, the document, its address, and the obligation of yours it touches.
The first question anyone asks is what this is about. The second is why it was yours to watch.
2. The two readings
For each: the date and time, the HTTP status, which fetch method returned it, the address it finally resolved to, and the fingerprint (SHA-256 hash) of the content.
The status and the final address tell a changed page from a moved one. A redirect to somewhere else is a different document, not a new version.
3. What differs, word for word
Every added and removed line between the two readings, unedited.
This is the part that doesn't depend on our reading being right, so it still stands if someone disagrees with us.
4. What moved in the record
The facts we read as added, removed or changed, labeled as our reading and kept apart from section 3.
A line moved is what the page did. A fact moved is what we made of it. Keeping them apart lets a reader check one against the other.
5. The dated copies
The stored PDF of each reading, with its own fingerprint, size and capture time.
A fingerprint proves two files are identical, not what they say. The copy is what a reader opens; the fingerprint ties it to this pack.
6. The third-party timestamp
The sweep manifest each reading appears in, the manifest's fingerprint, and the RFC 3161 token a timestamp authority signed over it.
Everything above is our word. A signed token from a party with no stake in the answer is what makes the pack evidence.
7. What this does not prove
Stated plainly: what a pack of this kind cannot establish.
A pack that claims more than it holds falls at the first challenge.
8. Who assembled it, when, and how to check
The date the pack was made, how, and the address to check it against the live record.
A pack is a copy of a moment. Saying so keeps it honest as it ages.

A real one: CoreWeave.

A recorded change with both readings kept as dated copies, a sub-processor that moved, and the shortest difference, so it fits on a page.

Document: subprocessors page
Address: docs.coreweave.com/policies/terms-of-service/sub-processors
Lines: 0 added, 2 removed

Before

Read at: 2026-10-14 09:57:21 UTC
HTTP status: 200
Resolved to: https://docs.coreweave.com/policies/terms-of-service/sub-processors
Fingerprint: 92b2db5fa35c7435…
Dated copy: PDF, 101 KB, fingerprint a97d53b518e163b7…, captured 2026-10-14 10:25:28 UTC
Timestamped in: manifest 20aaad2bf886ea44… (88 readings), signed 2026-10-14 09:59:38 UTC

After

Read at: 2026-10-21 09:51:40 UTC
HTTP status: 200
Resolved to: https://docs.coreweave.com/policies/terms-of-service/sub-processors
Fingerprint: 85522eeb9d7c1ea5…
Dated copy: PDF, 101 KB, fingerprint e0365453130fa90d…, captured 2026-10-21 10:07:56 UTC
Timestamped in: manifest fb16135dd75dfe37… (147 readings), signed 2026-10-21 09:54:29 UTC

What differs, word for word.

Unedited. This part doesn’t depend on our reading being right.

   Backblaze, Inc. | United States |-  Flexify Inc. | United States |   Microsoft Corporation | United States |

What moved, as we read it.

Kept apart from the difference above. A line moved is what the page did. A fact moved is what we made of it.

Fact	Movement	Before	After
subprocessor	removed	Flexify Inc. · United States	—

A page can change in several places when only one of them is a fact. That’s why an alert is decided on the fact, not the line.

Five things a pack can’t prove.

A pack that claims more than it holds falls at the first challenge.

That the vendor served this page to everyone.
It is what the address returned to our reader, at that time, from where it fetched.
That the change happened on the date we recorded.
It happened at some point between the two readings, and the pack states both.
That the vendor did or did not send notice.
The pack evidences a page; whether an email went out is a separate question.
That nothing else changed.
A pack covers the pages we read. A gap in the reading is a gap in the pack, not proof that nothing happened.
What the change means.
The pack quotes and fingerprints; what it means is for you, or your lawyers, to decide.

How many readings have a dated copy.

5,579

of 7,883 readings are kept as a PDF you can open.

4830

of 6937 recorded changes have both readings kept.

100

manifests carry a signed timestamp token.

A reading with no PDF still carries its fingerprint, the time we read it and its status. What it lacks is a file you can open.

Take the template with you.

A Word file with the eight sections and the real pack above, as it stands the day you open it.

Common questions.

What is an evidence pack?: A dated record of what a page said before and after it changed, put together so someone else can check it: two readings with their times and fingerprints, the word-for-word difference, the dated copies, and a third-party timestamp.
Why is a screenshot not enough?: A screenshot shows what somebody says a page said, and you have only their word for when it was taken. Nothing in the image ties it to a time that a neutral party will vouch for.
What is an RFC 3161 timestamp?: A signed token from a timestamp authority saying a given fingerprint existed at a given moment. Each time we read the pages we watch, the list of readings gets one, so the time doesn't rest on our own clock.
Does an evidence pack prove the vendor changed the page on a particular date?: No. It proves the page said one thing at the first reading and another at the second. The change happened between them, and the pack gives both times instead of picking one.
Why does the pack include the raw difference and not just the finding?: A line moved is what the page did. A fact moved is what we made of it. Showing only the second asks you to trust our reading, and the pack has to stand up if someone disagrees with it.

Prove what a page said

More for this job.

See every resource

This isn’t legal advice, and whether a pack like this is accepted depends on who is asking and why. The readings shown are pages we read on the dates stated. Naming a vendor records what its page said and implies nothing else. Corrections are free to request.