3. Prove — Your Readiness With Evidence
Documents alone are claims. This step is about turning those claims into something an auditor can independently verify.
The evidence chain
Why this matters more than the document itself
An auditor asking "how do you know this AI Literacy Policy hasn't been edited since your staff actually read it?" is a fair question. A plain PDF can't answer it. A document anchored with a cryptographic hash and a blockchain timestamp can — the proof exists independently of your own claim.
This is the same underlying infrastructure covered in depth on the RRVI™ Engineering Manifesto — this page is the practical "what it means for you" version.
Common questions
What does "proof" mean for a compliance document?
It means an auditor can verify a document existed in a specific state at a specific time and hasn't been altered since — not just that you say it's true.
What is SHA-256 hashing used for here?
Each generated document gets a unique cryptographic fingerprint (hash). If even one character changes, the hash changes completely, making tampering immediately detectable.
What is OpenTimestamps?
A free, open protocol that anchors a document's hash to the Bitcoin blockchain, creating an independently verifiable timestamp that doesn't depend on trusting any single company's server.
Does this replace formal certification?
No — it makes your evidence verifiable and inspection-ready, not certified. There is a real difference between readiness (structured, traceable, inspectable evidence) and formal third-party certification.
What would an inspector actually see?
A structured evidence trail: the document itself, its hash, its timestamp proof, and which module and responsible person it's tied to — reviewable remotely, without an on-site visit.