Register
Register of delivered analyses
We never change an analysis after delivery. This register lets you check that for yourself.
Why it matters
Our analyses are quoted in articles, reports and debates, sometimes long after delivery. Anyone can then ask whether the figures were adjusted later, for example after a story was published or a result became unwelcome. The timestamp answers that question without anyone having to take our word for it. Because the timestamps come from independent services, neither we nor the customer can change an analysis afterwards or backdate a new version without it showing. That protects the customer who publishes the figures, the readers who rely on them, and us.
For every analysis we deliver, we record a digital fingerprint (SHA-256) of three files: the PDF, the data file (CSV) and a locked copy of the report page. Two independent timestamp services timestamp the fingerprints under the open RFC 3161 standard, and we publish their receipts here.
What this proves: the files are exactly as they were on the delivery date.
What it does not prove: that the analysis is right. For that, read the method section in each analysis and our method page. Every analysis has sources of error, and we always do our best to state them.
| Reference | Delivered | Files and fingerprints (SHA-256) | Timestamps | Download |
|---|---|---|---|---|
| Loading the register… | ||||
Customer analyses are private. The register lists a reference and fingerprints only, never the topic or the customer. A fingerprint reveals nothing about the content of a file.
How to check an analysis
You need the files you want to check (the PDF, the data file or the locked copy of the report page) and the entry for the analysis in the register.
1. Check that the file matches the register. Calculate its SHA-256 fingerprint and compare it with the fingerprint in the register.
- Windows (PowerShell):
Get-FileHash report.pdf -Algorithm SHA256 - macOS:
shasum -a 256 report.pdf - Linux:
sha256sum report.pdf
If the codes are identical, the file is the one we delivered. If a single character differs, the file has been changed.
2. Check the timestamp (optional, needs OpenSSL). Download the fingerprint list (manifest.sha256), the two receipts and the certificate chains from the register entry, then run:
sha256sum -c manifest.sha256
openssl ts -verify -data manifest.sha256 -in manifest.digicert.tsr -CAfile digicert-chain.pem
openssl ts -verify -data manifest.sha256 -in manifest.sectigo.tsr -CAfile sectigo-chain.pem"Verification: OK" means the service confirms the fingerprints existed at the stamped time. To see that time, run openssl ts -reply -in manifest.sectigo.tsr -text.
3. Years from now. The services' certificates expire around 2035–2037. After that, add -attime with the stamped time, as shown next to each receipt, for example:
T=$(date -ud "$(openssl ts -reply -in manifest.sectigo.tsr -text | sed -n 's/^Time stamp: //p')" +%s)
openssl ts -verify -data manifest.sha256 -in manifest.sectigo.tsr -CAfile sectigo-chain.pem -attime "$T"We keep the full certificate chains with every receipt, so the check still works when the certificates are no longer in your system.
More about each service and how to check its receipt: DigiCert · Sectigo