Audit export integrity and verification
Verify signed export manifests and identify missing ranges without overstating completeness.
Tamper-evident audit exports include a signed manifest describing their record range and content digests. Verification detects changes to that exported artifact relative to its signed manifest.
Export manifest
Open Organization settings → Audit → Exports, select a completed export, and choose Download manifest alongside its record archive. Export permission is required for that scope.
The manifest identifies organization, selected scope, first and last event IDs, query interval, export revision, artifact digests, and signing-key ID. Chunked exports also record chunk order and linked digests so an archive can detect a missing or substituted chunk.
Store the manifest with the records and preserve the approved verification key through a separate trusted distribution path. Replacing both an artifact and its untrusted local key would defeat the intended verification boundary.
Verify
Use the release bundle's verification utility or the documented export format to check signature, artifact digest, required chunk set, and declared range. A digest mismatch must fail verification rather than produce a warning attached to an otherwise valid result.
Verification needs no permission to mutate infrastructure. Keep evidence review separate from the credentials used to create or rotate signing material.
Rotation
New exports identify the active signing version. Retain verification material for old versions while any required archive refers to them. Key rotation does not require rewriting prior records or pretending they were signed by a newer key.
Record compromise and revocation separately. A mathematically valid signature and a trusted signing key are related but distinct review questions.
Completeness limits
A valid artifact proves integrity of its declared exported set. It does not prove that no action occurred outside the selected scope or retention interval. Compare export cursors and archive continuity to detect gaps.
An expired local cursor can leave an unrecoverable historical gap even while later exports verify correctly. Report the missing interval explicitly rather than joining ranges as if delivery were continuous.
Use Audit API, streaming cursors, and compliance evidence for collection and review.