Does a compliance verification certificate prove my organisation is compliant?

No. A compliance verification certificate documents that a defined set of files is intact and unaltered against recorded hash values, scoped to a control you name. It supports your compliance evidence; it does not certify regulatory compliance itself. Whether a control is met is a judgement for your auditor or assessor based on the full body of evidence. e-Dex helps you produce the integrity attestation, not a compliance opinion.

What goes inside a compliance verification certificate?

It records the compliance scope and control reference (for example framework, control, audit period and auditor), an annexure listing each file with its size, SHA-256 hash and per-file result, an overall verification result such as verified=2 failed=0 errors=0, an integrity SHA-256 seal computed over the sealed content, and a signed declaration that the values were computed with e-Dex and reflect the integrity of the files.

Does e-Dex need an internet connection to generate the certificate?

No. e-Dex runs fully offline on your own Windows machine. Hashing the files, building the annexure, computing the SHA-256 seal and exporting the PDF all happen locally, so your evidence files never leave your computer. An internet connection is only needed if you choose to apply an RFC-3161 trusted timestamp from a Time-Stamping Authority.

How do I verify a compliance verification certificate offline later?

Recompute SHA-256 over each sealed-content line followed by a newline in UTF-8; the result must equal the SHA-256 seal printed on the certificate. To check the underlying files, re-hash them with e-Dex and compare against the SHA-256 values in the annexure. If the certificate was PAdES-signed and RFC-3161 timestamped, a standard PDF reader can confirm the signature and timestamp without any e-Dex-specific tool.

Which compliance frameworks can it support evidence for?

Because the certificate simply attests to file integrity for a control you define, it can support evidence for frameworks such as ISO/IEC 27001, SOC 2, and data-protection regimes like the DPDP Act 2023 and GDPR, as well as regulatory submissions where you must show that exported records were not altered. You record the framework, control and audit period as fields; e-Dex seals the file integrity behind them.

Compliance Verification Certificate: Audit Evidence

Article

P26-26) and the responsible auditor. Below that is the annexure: a numbered list of every file with its byte size, its SHA-256 hash and a per-file result of Verified. An overall verification result summarises the batch in one line — for example verified=2 failed=0 errors=0 — so the outcome is visible at a glance. The whole document is bound by an integrity SHA-256 seal, a single hash computed over every sealed line, and closed with a signed declaration stating that the hash values were computed with e-Dex and that the verification result accurately and completely reflects the integrity of the files against their recorded values.

Use Cases Across Frameworks

Because the certificate attests to file integrity for any control you name, it slots into many compliance workflows. For ISO/IEC 27001 internal and external audits, it backs the log, access-review and configuration evidence you hand to the assessor. For SOC 2 engagements, it lets you show the auditor that pulled samples and system exports were not edited between collection and review. For DPDP Act 2023 and GDPR evidence, it demonstrates that data-processing records, consent logs or breach-investigation exports are unaltered. And for regulatory submissions, it gives the regulator a clean, reproducible integrity statement over the files you file. In each case the framework, control and period are recorded as fields, and the file integrity is sealed behind them.

P26 and GDPR, as well as regulatory submissions where you must show that exported records were not altered. You record the framework, control and audit period as fields; e-Dex seals the file integrity behind them.

Conclusion

A compliance verification certificate gives compliance, GRC and audit teams a one-page, verifiable fact: these evidence files are intact for this control, proven by SHA-256 hashes and a cryptographic seal, and optionally signed and timestamped. It does not certify that you are compliant — that judgement stays with your assessor — but it gives them a defensible, reproducible basis to trust your evidence. You can produce one in minutes, offline, on a single Windows machine with e-Dex — the Digital Evidence Integrity Suite. Download it free and give your evidence pack an integrity backbone it can stand on.