Why does hash verification matter?
In traditional vendor risk, trust is reputational: you trust the vendor’s self-attestation, the auditor’s opinion, and your vendor risk tool’s data pipeline. Each link in that chain is a potential point of failure or manipulation. Hash verification breaks that chain: the sha256 of the original document is a mathematical commitment. If the hash matches, the document is exactly what was fetched at that timestamp. No intermediary in the chain can alter the document without invalidating the hash.
How does TrustVendor hash documents?
When TrustVendor’s fetcher retrieves a document — an HTML page, a PDF, a JSON API response — it computes the sha256 hash of the raw bytes before any processing. The hash and the document bytes are stored in TrustVendor’s immutable blob store. All subsequent processing — parsing, extraction, diffing — operates on the stored bytes, not on a re-fetched copy. The hash is the canonical identifier for that version of that document.
How do I verify a hash from the evidence drawer?
In TrustVendor’s evidence drawer, each artifact shows its sha256 hash. You can verify the hash by downloading the raw artifact (a button is provided) and running sha256sum <filename> (Linux/macOS) or certutil -hashfile <filename> SHA256 (Windows) and comparing the output to the displayed hash. If they match, the document you downloaded is byte-for-byte identical to what TrustVendor processed when it made the claim.
What does the “verify hash” button do in the UI?
The verify hash button in TrustVendor’s evidence drawer is not theatre — it recomputes the sha256 of the stored artifact bytes in the browser using the Web Crypto API and compares the result to the stored hash. If they match, a green indicator confirms integrity. This verification is client-side: the result does not depend on TrustVendor’s servers returning a specific answer. The browser does the math.