No Readable Company
How proof of destruction works
The certificate is a hash and a clock reading. Here is what that record can support, and where it stops.
What you get
After a shred, the app shows a SHA-256 digest of the original bytes, an ISO 8601 timestamp from the browser clock, and metadata: filename, media type, and size. You can download that as a PNG. The PNG is a picture of the same fields. It does not contain the file.
What the digest proves
SHA-256 maps an arbitrary byte string to 32 bytes, written as 64 hex characters. If two inputs differ by even one bit, the digests do not match (for any purpose you will actually hit). If you still have a file, you can hash it with any SHA-256 tool. Matching the certificate means those bytes are the same bytes that were hashed in this tab at that time, assuming the timestamp is trusted as a local clock.
The digest is computed from the file as stored, or from pasted text encoded as UTF-8. The app does not extract text out of PDF or Word and hash that extract. A PDF hashed here is the PDF file, not a transcription of its pages.
What it does not prove
- What the bytes said. You cannot read a document back out of SHA-256.
- That the file was deleted from disk, backups, email, or chat.
- That no other copy exists.
- That the event was witnessed by a third party. v1 does not publish the digest anywhere.
- That the timestamp is a trusted timestamping authority. It is your browser's clock.
How to recompute
On most systems: sha256sum yourfile or Get-FileHash in PowerShell. For pasted text, hash the exact UTF-8 bytes, including spaces and line breaks. If it matches the certificate, it is the same input. If it does not, it is not.
Why a company would want this
Retention rules often say a class of records must go after a date, while audit still wants evidence that a specific object was processed. A digest is that evidence without keeping the object. Pair it with your own deletion step and your own policy. Do not treat the PNG as a substitute for a vendor who must attend a destruction and sign a statutory form, if that is what you are under.