Statement Match — check a financial document's bytes

Someone gave you a financial document — a profit-and-loss statement, a tax return, a bank statement — and a fingerprint reference for it. Drop the file here and find out whether the bytes you hold are the exact bytes a preparer countersigned.

Checking a file here proves byte identity only — never that any figure is accurate. Rightshold stores fingerprints and timestamps, not documents: on this page your file is hashed in your browser and never leaves your device, and the by-bytes API hashes what it receives in flight and retains nothing.

What the answer means

MATCH — MATCH means only this: the file checked is byte-for-byte identical to a file whose fingerprint was countersigned at the time shown. It does not mean the figures in the file are accurate, complete, or current. It is not an audit, a review, or any other form of assurance, and Rightshold has never seen the file's contents.

NO MATCH — NO MATCH means only this: the bytes checked differ from every countersigned fingerprint. A file that was re-exported, re-saved, re-scanned, or redacted will not match even when nothing of substance changed, so a NO MATCH is not evidence that a document is false.

How a fingerprint gets countersigned

A document's preparer — a CPA, a bookkeeper, an accountant, or a document preparer — computes the file's SHA-256 fingerprint and countersigns it here under this attestation: “I attest that each fingerprint in this record was computed from the exact bytes of a document that I prepared, or that was presented to me, in my stated role, and that each fingerprint identifies those bytes and no others. This attestation covers byte identity only: it is not an audit, a review, or any statement that the figures in any document are accurate or complete.” Rightshold then countersigns the record with its own key. The record holds fingerprints, byte sizes, the countersigner's role, and timestamps — no document, no figures, no names.

Countersigned records so far: 1. Preparers countersign through the API: POST /v1/statement-match/countersign with an account key. Anyone can check, with no account: POST /v1/statement-match/check with a fingerprint, or POST /v1/statement-match/check-bytes with the file's raw bytes (hashed in flight, never retained; 32 MiB cap).