The audit runs on your machine. This page signs one thing only: the hash of a finished report, so a client can verify it later without ever seeing the draft. Nothing you wrote arrives here. Only hashes and a timestamp travel.
In grai, open the certificate, click Copy seal payload, then paste it below.
This is the signed record. Hand it to a client, and they can verify it below without trusting you.
Paste a sealed record here. This checks the signature against grai's public key, and it tells you if the record is fake.
A client pastes the exact draft and the sealed record. Then this page recomputes SHA-256 over the salt, a newline, and the draft, and compares the result to the signed draftHash. A match proves that exact draft was the one audited.
Hash only. The draft never leaves the writer's machine. What travels is a salted SHA-256 of the draft, plus hashes of the voice profile and settings, plus a signature over that bundle. If the server has no signing key, seal returns a clear error instead of an unsigned record.