Skip to content

The evidence pack

Quarterly aggregation of every receipt issued under your account, packaged in a format an assurance partner can review under ISAE 3000.

Structure

The evidence pack is delivered as a JSON-LD bundle plus a PDF executive summary, both signed against our audit-signing key. The bundle contains:

  1. Cover sheet — entity, account, period, methodology version, generated-at timestamp, signature
  2. Aggregates — climate (location + market-based), water (withdrawal + AWARE), resource (CML-IA ADP) per region per model family
  3. Per-receipt records — every receipt issued in the period as JSON-LD
  4. Methodology document — embedded at the version used at calculation time
  5. Calibration log — the calibration runs that produced the conformal intervals for the period
  6. Pedigree-score worksheet — every emission factor used, with its score and source
  7. Sub-processor change log — any changes to the inference path that affected boundary assumptions
  8. Assumption log — every modelled assumption with rationale (PUE, embodied amortisation lifetime, batch-size estimation procedure)
  9. Sigstore attestation — verification path for receipt signatures

Sample evidence pack

A redacted sample for a fictional Wave-1 reporter is at /static/sample-evidence-pack-redacted.pdf. It demonstrates the format and the level of detail; real-customer evidence packs are NDA'd unless the customer chooses to publish.

How customers consume it

Three options:

  1. Download from dashboard. The dashboard surfaces the latest quarterly evidence pack as a downloadable bundle.
  2. API export. POST /v1/vetted/evidence-pack with a date range produces a bundle on demand. Useful for custom reporting periods.
  3. Direct delivery to assurance partner. With customer authorisation, we send the evidence pack directly to the assurance partner's named contact, bypassing customer-side processing.

Cadence

The evidence pack is generated quarterly, by the 15th day of the month following quarter end. Annual evidence packs (Q4) include the year-end ISAE 3000 opinion as an additional document once issued (typically Q1 of the following year).

Retention

Evidence packs are retained for 7 years per CSRD evidence-retention norms. Customers may request a deletion certificate at end-of-relationship; we explain statutory retention obligations where they apply.

Verification

A reviewer (your auditor, your sustainability team, an independent third party) can verify the integrity of the evidence pack:

# 1. Fetch our public audit-signing key
curl -O https://trust.vettedinference.com/audit.asc
gpg --import audit.asc

# 2. Verify the evidence pack signature
gpg --verify evidence-pack-2026-q1.json.asc evidence-pack-2026-q1.json

# 3. Verify a sample receipt's Sigstore attestation
cosign verify-blob \
  --bundle receipt-chatcmpl-vi-9f3c2e.bundle \
  receipt-chatcmpl-vi-9f3c2e.json

What is not in the evidence pack

  • Prompt or completion content. Per Article V of our Articles, we do not retain this content; it cannot appear in the evidence pack because it does not exist.
  • Customer-private business context (internal user IDs, customer-side metadata) — preserved only if the customer chose to attach metadata at request time.
  • Other customers' aggregates. The evidence pack is per-customer.

Where this is implemented

methodology/aggregation/evidence_pack.py