Sample record · Third-party risk

A vendor's support agent exports more than the contract names

A vendor's AI support agent uses a read-scoped token to export 212 customer tickets to the vendor's own analytics bucket. Three tickets contain API keys pasted by users.

Fictional scenario, real seals. No company, person or transaction here is real. Each record was sealed on Verdict’s public sandbox and logged on Sigstore Rekor, a public log Verdict does not run. This chain was sealed in one sitting, so its log times are seconds apart; in a live deployment each step is logged when it happens.
What the log time settles in a real case

When the export happened, measured against the contract and the date the customer was told.

  1. Step 1 of 1 · Vendor AI agent exports ticketsAwaiting human review

    The agent exported 212 support tickets to the vendor's own analytics bucket. 3 of the 212 tickets contain API keys that the customer's users pasted into the ticket text. Nothing in the vendor contract names this export.

    Logged on Rekor
    2026-10-13 05:38:45 UTC
    Log index
    3241807281
    Record id
    ser_de2af1644fb2d45bbdcc67fce944dac4
    Verify in your browser →Open the Rekor entry ↗Download the record

How to check the time yourself. Open the Rekor entry and compare its logged hash with the SHA-256 of the record’s commitment, which the verifier shows. If they match, the entry’s integrated time is the earliest moment this content is proven to have existed. Log times above were read from Rekor on 2026-10-15.

A record proves what it says has not changed since it was logged. It does not prove the event happened as described, or who made the record. What Verdict proves, and what it doesn’t →

All sample records →