Why reports are signed
A PDF is easy to edit. A signature makes an edit visible. Each report is fingerprinted with SHA-256 and signed with ML-DSA-65 (with a SHA-512 digest of the signed data), the post-quantum signature standard NIST published in 2024 as FIPS 204.
Where the key is
Every compliance product publishes its public signing key at /.well-known/rootsystems-signing-key.json on its own address. The key only checks signatures; it cannot create them.
Checking a report
Check a report on the product's Reports page. Reports from Offboarding, Vendor Risk, HIPAA, Standards and AI Agent Trust can also be checked by anyone, without an account, on that product's public /verify page (for example offboarding-proof.onrender.com/verify): upload its manifest, PDF and CSV and get a pass or fail. Technical teams can also check the signed manifest against the published key with any ML-DSA-65 library. If one character of the report changed, the check fails.