What an evidence pack is
An evidence pack is the attested PDF an assessor reads. Generate writes it. The fingerprint is integrity, not a digital signature. Tagnovo does not certify.
Last reviewed September 2026.
The screen this guide means
“Evidence packs” is the Manifest tab with that name. It is not Script inventory and not Pages that take card details. The block below is that screen.
Evidence packs
No packs yet. Generate writes an attested PDF from the record for this month. Name, role and email go on the cover. Approving a script does not create a pack.
What is in a pack
Explanation only — not this workspace's rows. A pack is generated from the record. Nothing written by hand.
- Named attestation
- The person, role and email on the cover — the 6.4.3 human authorisation record
- The inventory
- Every authorized script, the reason given, who authorized it, and when
- Every check
- Timestamp, page, what was seen, and how it was seen
- Every change
- What changed, when, and who reviewed it
- Headers
- Security headers as the customer's browser received them
- Record fingerprint
- SHA-256 of the canonical record. It verifies the record was not changed, not who attested it, and not that the PDF is digitally signed.
What this is for
An assessor, a QSA, or the acquiring bank may ask for a file that shows every script on pages that take card details, why it was allowed, who attested that, and whether anything changed later. That file is the evidence pack: a generated PDF for a period, with a record fingerprint on the cover so anyone can verify the canonical record was not changed.
The fingerprint verifies integrity. The named person is an attestation. Neither is a cryptographic digital signature of the PDF.
PCI DSS 6.4.3 wants an authorized inventory — a written reason and a named person, not a list a system invented. 11.6.1 wants change detection of scripts and security headers as the customer's browser received them. The pack is that record for one period. We keep it. We do not certify compliance and nothing here is an assessment.
What is in a pack
Explanation of the file — not numbers from your store. A pack is generated from the record. Nothing is written by hand.
- Named attestation
- The person, role and email on the cover — the 6.4.3 human authorisation record
- The inventory
- Every authorized script, the reason given, who authorized it, and when
- Every check
- Timestamp, page, what was seen, and how it was seen
- Every change
- What changed, when, and who reviewed it
- Headers
- Security headers as the customer's browser received them
- Record fingerprint
- SHA-256 of the canonical record. It verifies the record was not changed, not who attested it, and not that the PDF is digitally signed.
How to generate one
Open Manifest → Evidence packs. Enter the name, role and email of the person attesting this period, then click Generate. Those three go on the cover. The period is this month, from the first day through the moment you click. Approving a script does not create a pack. An empty list means nobody has clicked Generate yet, not that the inventory is empty.
Confirm your authenticator if this session has not done that in the last fifteen minutes. We will not text a code.
Download is on the row. The record fingerprint on the list is the same checksum printed in the PDF. A pending script is listed as not authorised.
Declare checkout and cart paths on Pages that take card details before you expect payment-page coverage in the file.
Open the screen this guide means
Generate writes an attested PDF from the record. We do not certify.