Proof Receipts
What it is
A proof receipt is a small, signed, structured statement about one measured claim — the
numerator, the denominator, and what was left unknown — issued at /proof and downloadable as
JSON. It is independently checkable by anyone, without contacting CMDash: the signature, the
transparency-log placement, and the freshness window can all be checked offline against your
published key, using the public verifier.
Every receipt states its basis, shown as a badge next to the claim:
- Measured — the numerator/denominator/unknown came from a connected integration (for example, an identity provider's MFA setting count).
- Self-assessed — a status your team recorded (for example, a control marked Implemented).
- Self-attested — a person's statement in their stated role, with no measurement behind it. This label is always shown, never left to be inferred (CMDash never lets AI draft evidence, receipts, or attestations — every self-attested claim is a person's own words).
Each receipt also carries a freshness badge (Fresh/Stale, based on the claim's stated freshness window) and a status (Active, Superseded, or Revoked — a superseded receipt stays downloadable and verifiable; it is not deleted).
When to use it
Use Proof Receipts whenever you need to prove something you've already assessed or measured — to a prime contractor, an insurer, a customer's security team, or your own Signer's File — without emailing a screenshot or a PDF that the recipient has to trust on your word. A receipt is checked by anyone who has the receipt file and, if you've published them, your public keys — not by asking CMDash "is this valid," which would only ever mean "the server agrees with itself."
Before you start
- Tier: No tier gate — Proof Receipts are included on every tier, FREE and up.
- Role: Any authenticated member can view receipts. Issuing (Refresh now), toggling published keys, and creating a share bundle are OWNER/ADMIN only — everyone else sees a read-only note.
- FREE tier: a Free workspace can have 3 active shares (live share links plus active relying-party grants;
revoked and expired ones do not count). A fourth is refused with
FREE_SHARE_LIMITuntil you revoke one or upgrade. See Free tier.
How to
Issue and refresh receipts
- Open Proof receipts (
/proof). - Click Refresh now. This measures every claim your organization is entitled to and issues a fresh receipt for each one. The previous Active receipt of that claim moves to Superseded, not deleted — it stays downloadable and verifiable.
- The refresh result shows how many receipts were issued, skipped, and failed.
Publish your keys
Receipts are signed the moment they're issued either way — publishing is what lets someone else actually verify one, by fetching your public key document rather than trusting CMDash to vouch for it.
- On the Proof receipts page, use the Publish your proof keys toggle.
- Off (the default): receipts are signed, but no relying party can fetch your key document to verify them.
- On: your key document is served publicly at the URL shown under the toggle, so a receipt's signature can be checked by anyone who has the receipt file.
Look at one receipt
Click a claim to open /proof/<receiptId>, which shows the full signed payload, its status, and
where the transparency log placed it. From there you can:
- Download JSON — the receipt file itself, exactly as signed.
- Verify → — opens the public verifier in a new tab, pre-ready to check this deployment's receipts (drop or paste the downloaded file into it).
Share receipts with a relying party
- On
/proof, select one or more receipt rows (checkboxes), or click Bundle links with nothing selected. - This opens the same share-link dialog used for board packs, compliance reports, and posture snapshots, set to a proof bundle kind.
- The resulting link can be opened by anyone it's shared with; opening it (or its
?r=<token>&id=<receiptId>verify link) loads the frozen receipt bytes into the public verifier — see Verifying a proof receipt.
Common questions
Does refreshing change what a receipt says? No — refresh issues a brand-new receipt with a new id for the current measurement; it never edits an issued receipt. The old one moves to Superseded and stays exactly as it was signed.
What happens if I never publish my keys? Receipts still exist, download, and can be attached to your Signer's File and shared through a bundle link — but nobody outside CMDash can independently verify the signature until you turn the toggle on, because there's no published key document to check it against.
Why does a receipt say "Self-attested" instead of a number? Some claims (for example, an affirming official's statement) have nothing to measure — they're a person's own words about their role. CMDash labels these visibly everywhere they appear rather than presenting them the same way as a measured count.