Proof of what was exposed - signed, and yours to keep.
Every scan is a point-in-time snapshot. Turn any of them into an Evidence Pack: a signed PDF and JSON record of exactly what was exposed, or exactly what changed between two scans - something an auditor, insurer or client can check for themselves, without an account and without taking your word for it.
Already monitoring a domain? Create an account and generate your first pack from the Evidence Center.
Why a dashboard, a screenshot or a report isn't enough on its own
A live dashboard only proves today
A dashboard is honest in the moment, but nothing about it survives being handed to someone else - by the time an auditor or insurer looks, the state has already moved on.
A screenshot proves nothing to a stranger
Anyone can crop, edit or mistime a screenshot. Someone who wasn't there has no way to check it's real, unmodified, or actually from when you say it's from.
A written claim is still just your word
"It was secure as of last Tuesday" is a statement, not evidence - not unless whoever reads it can check it themselves, without having to trust you.
How an Evidence Pack is different
A signed snapshot of exactly what was exposed
Generate an Evidence Pack from any past scan - every open port, live web service, TLS certificate and confirmed DNS record observed at that moment. Or generate a comparison pack showing exactly what changed between two scans.
Signed with our Ed25519 key, checked in your browser
Every pack is cryptographically signed. Anyone can check the signature themselves at /verify - upload the file, the check runs locally in their browser, and the file is never sent to SurfaceDiff or anyone else.
A PDF to read, a JSON file to check
Each pack is a .zip containing a human-readable PDF and its evidence-pack.json companion - the exact canonical data that was signed. The readable version and the provable version are never two different documents that can drift apart.
One token, included free on every plan
Generating a pack costs 1 token. The Free plan includes 2 a month as part of its regular token allowance, no card required - on paid plans it's the same 1 token from your normal balance.
When teams actually reach for one
A client, insurer or auditor asks you to prove a specific date's exposure - generate a snapshot pack for it instead of digging up an old screenshot.
Closing out an incident - generate a comparison pack showing precisely what changed between the state before and the state after, as the permanent record of what happened.
Running this for clients? Hosting providers and MSPs can hand a signed pack to a client as the evidence behind a security review or SLA conversation, without granting them access to the rest of the account. See how shared-server monitoring and per-client access work.
FAQ
What's actually inside an Evidence Pack?
A .zip containing a signed, human-readable PDF and an evidence-pack.json file - the exact data that was signed. A snapshot pack lists every open port, live web service, TLS certificate and confirmed DNS record observed as of one scan. A comparison pack lists exactly what changed between two scans.
How do I verify a pack is real?
Upload the .zip at /verify. The check runs entirely in your browser - the file is never uploaded anywhere - and confirms the signature against SurfaceDiff's published Ed25519 public key.
Does the person I send it to need a SurfaceDiff account?
No. Verification at /verify needs nothing but the file itself - no login, no account, nothing installed.
What's the difference between a snapshot pack and a comparison pack?
A snapshot pack records everything exposed as of one scan - useful for proving a point-in-time state. A comparison pack records exactly what changed between two scans - new ports, vanished services, changed certificates - useful for documenting a specific incident or change window.
How much does it cost?
1 token per pack. The Free plan includes 2 a month as part of its regular token allowance; paid plans draw the same 1 token per pack from their normal balance.
Is the signing key the same for every customer?
Yes. SurfaceDiff signs every Evidence Pack with one company-wide Ed25519 key, published at /verify. It isn't a per-customer key, so the same verification step works for every pack we issue, for every customer.
Can I regenerate a pack for a past scan?
Yes, as long as the underlying scan is still in your history - SurfaceDiff keeps every past scan, not just the latest. Each pack is produced fresh at the moment you ask for it, so regenerating one costs another token.
Related
Get your first signed pack
Run a free scan, or add a domain you already monitor, and generate an Evidence Pack from the first baseline.
Start a Free ScanOne verified domain. No credit card required.