How to Check a WHIG Evidence Record Is Genuine

This guide covers server-signed WHIG records from earlier versions of the app. A certificate format and fingerprint timestamp for records made today are still in development, so this guide does not describe them. Records made with the current app are not server-signed. A service timestamp does not prove when a video was filmed. See the security page for that distinction.

WHIG's public key is not yet published, so the check at whig.app/verify is not available yet. The steps below describe how it works once the key is published.

The following checks are for insurers, brokers and loss adjusters who have received an existing signed record.

Once the key is published, everything below can be checked without contacting us.

What you have been given

An Evidence Package from an earlier version of WHIG contains an Evidence Record PDF listing the owner's contents with estimated replacement values and frames drawn from a video walkthrough, a Certificate of Integrity, and a structured JSON export that includes the sealed record. Packages made with the current app do not include a Certificate of Integrity or a sealed record.

The sealed record is the part that matters to you. It contains no inventory content. It is a set of SHA-256 hashes of each stage of processing, each one signed with ECDSA on the NIST P-256 curve.

How to verify it

1. Open whig.app/verify.
2. Open the claimant's JSON export and copy the sealed record, or paste the whole file. The page will locate it.
3. Paste it into the box and run the check.

Once the key is published, the page fetches it, verifies each signature in the record, and reports every pipeline step as valid or invalid.

Two things worth knowing about how this works:

• It runs entirely in your browser. Nothing is uploaded, to us or anyone else. You are not telling WHIG that a claim is being assessed, and you are not transmitting the claimant's data to a third party.
• You do not need an account, and you do not need to install anything.

The mechanism, briefly

Every step of WHIG's processing pipeline computes a SHA-256 hash of its output and signs that digest with a private key held in AWS Key Management Service. The key is generated inside KMS and is never exported, including to WHIG. Signing happens by API call; the private key material does not exist outside the HSM.

The corresponding public key will be published at whig.app/.well-known/whig-evidence-key.pem, which is what the verification page checks against. Once it is, you are welcome to fetch it and verify signatures with your own tooling, using any standard ECDSA P-256 implementation, rather than trusting our page.

Because the signatures cover hashes of the content, altering any part of the sealed data changes its hash, and the signature no longer verifies. There is no way to edit a sealed record and have it still pass.

What a successful check establishes

Be precise about this, because it matters:

• Authenticity. The record was signed by WHIG, using a key nobody else holds.
• Integrity. The record has not been altered, by even one character, since it was signed.
• Signing time. The record carries the time at which WHIG signed it, and that time is covered by the signature. It is WHIG's own clock at signing, so it relies on trusting WHIG. It is not an independent timestamp, and it is not when the video was filmed.

Taken together: a record that verifies shows that WHIG signed exactly this content, at the time its own clock recorded. It does not show when the walkthrough was filmed.

What it does not establish

We would rather tell you this than have you discover it and stop trusting the rest.

Verification does not prove that the items listed ever existed, nor that they belonged to the claimant, nor that they were still in the property at the time of loss. It shows the record matches what WHIG signed and has not been altered since. It is a statement about the document, not about the world.

It also does not vouch for the values. WHIG produces automated estimates of replacement cost from retail pricing data. They are estimates, not professional valuations, and the Evidence Record labels them as such throughout. High-value and specialist items are flagged for assessment by a qualified valuer, and the record distinguishes WHIG's estimate from any value stated by the owner.

What verification settles is whether the signed record has been edited since WHIG signed it. Whether it was made before the loss rests on WHIG's signing time, which means trusting WHIG's clock. Everything else about the claim remains a matter for your professional judgement.

Why a self-made inventory is different

You will more often be handed a spreadsheet, a folder of photos, or now an AI-generated PDF. Those may well be accurate, and most claimants are honest.

But none of them can answer the two questions your process exists to ask: did this exist before the loss, and has it changed since. Their dates are self-reported and their contents are freely editable, so they can only ever be assertions by an interested party.

A signed record answers the second question. It answers the first only as far as you trust WHIG's clock.

Questions

If something does not verify and you believe it should, or you want to check a record with your own tooling once the key is published, contact us at whig.app/contact. We will not ask for the claimant's data.