How We Make Sure Nobody Can Fake a Gumshoe Report

A verification report only has value if the person reading it can trust it came from where it says it came from. A PDF can be edited. A score can be changed. A FAIL can become a PASS with a text editor and five minutes, unless something prevents it — or at least makes the tampering detectable.

Every report Gumshoe generates now carries a unique watermark pattern, tied cryptographically to that specific document, checkable independently of the PDF itself.

What the Watermark Actually Is

Each report gets a document code — a short string encoding the case ID and a timestamp, signed with an HMAC so the signature can be verified without needing access to the original database record. That code seeds a deterministic pattern generator: a sparse, organic, faceted "cracked glass" pattern, tiled faintly behind the report content, unique to that document because it is mathematically derived from that document's specific signed code.

Two different reports never produce the same pattern, and the same report regenerated later produces the identical pattern every time — because the pattern is computed from the code, not stored as an image anywhere. There is nothing to leak and nothing to lose; the visual pattern is fully reconstructable from the code alone.

Checking a Document Is Genuine

Every report includes a plain-text Document ID and a link: gumshoe.au/verify/doc, with the code attached. Anyone holding a copy of a report — the supplier being verified, a colleague, an auditor reviewing the file months later — can visit that link, and the page independently re-derives the expected signature from the code, checks it against what the code claims, and confirms whether the document is authentic: the entity, score, and date it claims to represent, pulled fresh from Gumshoe's own records rather than trusted from the PDF's text.

The same watermark pattern renders behind the verification page itself, generated fresh from the same code — so the pattern you see checking a document's authenticity is the same one printed on the document being checked. It is a visual confirmation alongside the cryptographic one, not a substitute for it.

Why This Matters Beyond Gumshoe

A verification report often travels well beyond the person who generated it — into a supplier file, an audit pack, a tender submission, sometimes years after it was created. The further a document travels from its source, the more valuable an independent, no-login-required way to confirm it is genuine becomes. A login-gated "check this report" feature only works for people who have a Gumshoe account; a public verification link works for anyone holding a copy, which is the actual audience that matters for a document meant to be trusted by a third party.

Next time you generate a report, check the Document ID line and the link beneath it. That is not decorative — it is the part of the document that proves the rest of it is real.

Uncommon Insights

One of the lesser-known benefits of Gumshoe's watermark and signature scheme is its potential to aid in ASIC's and the ATO's anti-money laundering (AML) and counter-terrorism financing (CTF) efforts. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), reporting entities must maintain robust systems to detect and prevent suspicious transactions. By providing an independently verifiable audit trail, Gumshoe's reports can help entities meet these obligations, particularly in high-risk sectors such as finance and real estate.

It's worth noting that the Corporations Act 2001 (Cth) imposes strict obligations on companies to maintain accurate records, including financial reports (s 286). By using a cryptographically secure signature scheme, Gumshoe's reports can help companies meet these obligations and reduce the risk of non-compliance. Furthermore, in the event of a dispute or investigation, the unique document code and signature can provide a clear and tamper-evident record of the report's contents and provenance.

ASIC's Regulatory Guide 34 (RG 34) sets out the Commission's expectations for auditor independence, including the need for auditors to maintain their independence in appearance as well as fact. By providing a secure and independently verifiable audit trail, Gumshoe's reports can help auditors meet these expectations and reduce the risk of perceived conflicts of interest. This is particularly important in high-stakes audits, where the integrity of the audit process is paramount.

The ATO's increasing focus on data analytics and digital transformation (as outlined in its 2020-25 Corporate Plan) highlights the growing importance of secure and verifiable data in tax compliance and enforcement. By using a cryptographically secure signature scheme, Gumshoe's reports can help taxpayers and their advisors meet their obligations under the Taxation Administration Act 1953 (Cth) and reduce the risk of errors or disputes. This is particularly important in high-risk areas such as transfer pricing and international tax, where the ATO is increasingly using data analytics to identify and address non-compliance.