The screenshots-in-a-folder method, and where it breaks

The status quo in most organisations is a person, a browser, and a folder. Someone opens the site, opens the chat, screenshots the greeting, saves it with a date in the filename, and moves on. This is not a foolish approach. It captures the right thing, which is more than a questionnaire does. The problems are practical.

What a screenshot does not carry

A PNG on a shared drive carries no reliable time. Its file metadata is whatever the filesystem says, changes when it is copied, and is trivially editable. It carries no record of what else was on the page, what the network did, or whether the widget was in its first-interaction state or a state the screenshotter had already clicked through.

It also carries no evidence of its own integrity. If a file is questioned, there is nothing to check it against. That is the specific thing sealing fixes: the manifest hashes every artefact, so recomputing a hash shows whether the file is byte-for-byte what was captured.

The coverage problem

Manual capture scales badly, and it degrades in a predictable order. The homepage gets checked. The support subdomain does not. Desktop gets checked; mobile does not, which is where most first interactions happen. It gets done in the week before a deadline and not again, so the record covers one day of the year.

For an agency or counsel with a portfolio, the arithmetic is worse still: multiply one careful manual pass by every client site, then by every time anything changes.

What sealing adds

A sealed record is the same screenshots plus the things that make them answerable: a fixed capture time, the DOM and network context around them, the rule version they were graded under, and a SHA-256 manifest covering every file. Anyone holding the pack can recompute those hashes and show nothing was altered, without asking us anything.

We are precise about the limit of that. The hash proves integrity and you can check it yourself. The signature over the manifest hash proves we sealed it, and that one is a shared-secret signature only we can confirm, so we say so rather than implying more.

When DIY is genuinely fine

If you need to check one thing once, open a private window and look. That is free, immediate, and often the right answer, which is why the manual 60-second check is printed in our own reports.

The moment it stops being enough is when the record has to survive a question from someone else: a supervisory authority, a client, an acquirer, an insurer. At that point what matters is not that you looked, but that you can show what you saw and when.

Side by side