Auditor Proof Room

What it is

The proof room is the part of an external assessor's My Access page (/assessor-access) that lists your organization's signed proof receipts, limited to the frameworks the assessor was granted. Each receipt can be downloaded as the file the verifier checks, so an assessor can check it on their own machine without asking CMDash whether it is valid.

Receipts also reach assessors two other ways: you can attach receipts to an evidence request (a PBC request) as the answer, and an assessor can sample from a Receipts population in Sampling Export.

When to use it

When an assessor asks for evidence you have already measured and signed. Instead of exporting screenshots, point the assessor at the receipt.

Before you start

Tier: the receipts need no tier (PROOF_RECEIPTS is on every tier). The assessor's access itself is the existing External Assessors feature; see Audit programmes.
Role: assessors get read-only access. Inviting an assessor and answering evidence requests are the organization's OWNER or ADMIN.
Scope: the assessor's grant names frameworks. That list decides what they can see.

How to

What an assessor can and cannot see

Only receipts wholly inside the grant. A receipt names the controls it speaks to. It is in scope only if it names at least one control and every control it names belongs to a framework on the grant. A receipt that also speaks to a framework outside the grant is not shown, so the receipt cannot carry a framework the assessor was never engaged for. A receipt with no named controls is in no framework's scope. A grant with no frameworks sees nothing.
An out-of-scope receipt looks like one that does not exist. The detail and the download both answer "not found" for a receipt outside the grant and for one that is not yours, so ids cannot be probed.
Revocation and expiry are immediate. The scope is read from the live grant on every request, never from anything the assessor sends.
Never the evidence. The room returns the same signed receipt a relying party gets: no evidence salt, seed or evidence items. Opening evidence is your decision, not a read the assessor can make.
Everything is audited. Each read, including each download and which receipt, is written to your audit log.
A capped list says so. The list scans a bounded number of receipts. If the scan stopped before filling the page, the response says it was truncated, so a short list is never mistaken for the whole population.

Check a receipt offline (assessor)

On My Access, find Proof room. Each row shows the status, when it was issued and when it stays fresh until.
Download the receipt file.
Run cmdash-verify on it, or drop it into the public verifier. The verifier needs your deployment's published proof keys; an organization that has not published them can be downloaded from but not independently verified. See Proof receipts.

Answer an evidence request with receipts (organization)

Open the evidence request (/evidence-requests) and submit your answer.
Under Proof receipts, tick the receipts that answer it. You can attach receipts, evidence items, or both; at least one is required.
The system refuses a receipt that is not yours, is revoked, or speaks to anything beyond the request's own framework. That keeps every attached receipt readable by an assessor scoped to that framework.

Sample receipts (Sampling Export)

Sampling Export has a Receipts population. For an assessor session it contains only receipts in the grant's frameworks, and the total shown counts only those, so the denominator an assessor sees never includes a receipt they may not see. Each row carries the receipt digest, claim id, status, assertion kind, issue and freshness dates, and the exact cmdash-verify command to run on the downloaded file. If the scan hit its row ceiling, the population is reported as truncated: for an assessor the count is then a lower bound, not the whole.

Common questions

Can an assessor see receipts from before they were invited? Yes, if they are in the granted frameworks: the room lists receipts by scope, not by date. Superseded receipts stay listed and verifiable.

Does the proof room prove the control works? No. A receipt proves what was measured and signed and that it has not changed. The verifier lists what it does not establish.

This page is the product manual, published from the repository at docs/user/feature-guides/auditor-proof-room.md. Customers read the same text inside CMDash under Help. Last updated October 4, 2026.