The auditor's view
This is what a named auditor sees through a Custody grant, on vciy's own public example record. Specimen data, same page: the grant, the attestation and the reads below are fixed examples with a fictional auditor, shown by the code that renders the real pages. The record itself is the real public example.
The grant
The owner names the auditor, the firm, the purpose and the dates. Each is in the grant log, which is hash-linked. The line below is the vault's check of it.
verified: chain intact
The sentence the auditor attests to
Before the first read the auditor types their name and confirms this sentence. Their name and the time are recorded in the grant log.
What the auditor is offered
Priya Raman, Northgate Assurance LLP. Purpose: SOC 2 Type 2 fieldwork. Open from 1 Oct 2026 to 31 Dec 2026.
You can read these records. You cannot change them. Each time you open one, it is listed in its access history.
The record, as the auditor reads it
CVE-2021-44228
30ee0a75-de6b-48de-a9ad-21f444ed73ce · v1A vciy decision record, version 1 of 1. This page re-derives every hash below from the stored bytes each time it loads.
- Subject
- CVE-2021-44228
- Identity
- cve: CVE-2021-44228
- Verdict
- Mitigated
- Review by
- not set
- Rationale
- Upgraded log4j-core to 2.17.1 across every service during the December 2021 disclosure window. Kept here as vciy's own worked example: the record and the mitigation date line up, and the evidence below is what the index held at the moment this was recorded.
- Context note
- none recorded
- Decided by
- demo@vciy.com
- Recorded
- 2026-09-12T00:20:47.247000000Z
- Under custody
- 20 days, since 2026-09-12
- This version's hash
- 9ad7752cebd9a6564dc7d4dc486d76ea48ed3b99d6ba3f93149ab6a520496477
- Links back to
- 0000000000000000000000000000000000000000000000000000000000000000 (genesis, no predecessor)
Evidence frozen at recording
What the vciy index held for CVE-2021-44228 when this version was recorded on 2026-09-12, frozen into it.
| Fact | Value as recorded | Source |
|---|---|---|
| Known exploited | Listed in CISA's Known Exploited Vulnerabilities catalogue, added 2021-12-10, remediation due 2021-12-24 | CISA KEV catalogue, release of 2026-08-17 |
| EPSS score | 0.99999, model v2026.06.15 | EPSS, release of 2026-06-15 |
| Weakness, per the CNA | CWE-502 Deserialization of Untrusted Data; CWE-400 Uncontrolled Resource Consumption; CWE-20 Improper Input Validation | CVE Program record, cvelistV5 release of 2026-09-04 |
| Weakness, per NVD | CWE-20; CWE-400; CWE-502; CWE-917 | NVD's analysis, load of 2026-09-04 |
| Severity, per NVD | 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD's analysis, load of 2026-09-04 |
| Affected version ranges |
| NVD's analysis, load of 2026-09-04 |
| Fixed version | 2.3.1; 2.12.2; 2.15.0 | CVE Program record, cvelistV5 release of 2026-09-04 |
When this was recorded, the newest release the index held of each source was: CISA KEV catalogue, release of 2026-09-11; EPSS, release of 2026-09-10. A value dated earlier is the one the index still held at that moment.
- Snapshot id
- sha256:71b6a00f410ff00dcbf38af19432bf646f57dc201dde87b69c5ba3d7e6bd2165
These values are part of v1's canonical bytes, so they are covered by v1's hash in the chain below. Change one character and that hash no longer matches. The snapshot id is the SHA-256 of exactly these values, recomputed on this page load. This page shows the values as they were recorded. It does not fetch them again from their sources, so it does not tell you whether a source has changed since.
The whole chain
- v1 mint 9ad7752cebd9a6564dc7d4dc486d76ea48ed3b99d6ba3f93149ab6a520496477 2026-09-12T00:20:47.247000000Z
Check it yourself
Do not take this page's word for it. The verifier below shares no code with this service: it is a single file with no dependencies, written from the published canonical form rather than from our implementation, and both are downloadable here. Run these three lines in an empty folder. They need no account.
curl -sL -o vdr-30ee0a75-de6b-48de-a9ad-21f444ed73ce.json https://app.vciy.com/r/proof/30ee0a75-de6b-48de-a9ad-21f444ed73ce/export.json curl -sLO https://app.vciy.com/r/verify-vdr-export.mjs node verify-vdr-export.mjs vdr-30ee0a75-de6b-48de-a9ad-21f444ed73ce.json
The vdr.v1 export The verifier The canonical form it was written from
What that check does and does not settle. It re-derives every hash from the bytes in the export and confirms every version links to its predecessor, so a changed character anywhere is caught and named. It cannot tell you the export came from this record: the document is internally consistent, not anchored to anything outside itself. The export names this page as its proof_url for exactly that reason. Compare the two.
The owner's side: access history
Every read the auditor makes is listed on the record, with the vault's own check that no entry was removed.
Access history
Auditor grants: let a named auditor read your records for a set period.
verified: chain intact
| When | Who | How | Version |
|---|---|---|---|
| 2026-10-01 16:40 UTC | A member of your organisation | page | v1 |
| 2026-10-02 09:15 UTC | Priya Raman (auditor) | page | v1 |
| 2026-10-02 09:21 UTC | Priya Raman (auditor) | export | v1 |
| 2026-10-05 13:02 UTC | Priya Raman (auditor) | page | v1 |
What the auditor can and cannot do
The auditor can read every record in the grant, for the dates on it, after typing their name and confirming the sentence above. They cannot change, delete, amend or void anything. The link opens these records and nothing else. Each time they open a record, the read is added to its access history with their name, and ending the grant closes the link at once.