TL;DR
- The database trap: most "independent verification" is actually vendor-dependent. You log into their system and trust their database.
- The independent proof: Klariqo seals every call into a signed record and adds an independent RFC 3161 trusted timestamp from a recognized authority, the same standard behind legal e-signatures. The proof does not come from Klariqo.
- Verify it yourself: download the evidence bundle and run one standard command. It confirms the record is unaltered and when it existed, offline, with no Klariqo system in the trust path.
- The boundary: this proves the record has not been altered and when it existed. It does not validate consent or make your call center compliant. You own your compliance program; we provide the evidence.
If a regulator or auditor asks you to prove a call recording was not altered, and your only proof is a file generated by your own software vendor, you do not have proof. You have an assertion.
True independent verification of a call record means any reviewer can confirm the file is unaltered and existed at a specific time, without relying on the system that generated it. In any dispute, an auditor or opposing counsel asks a simple question: who controls the system that produced this record? If it is run by you, or by a vendor who lets you delete records with a click, the evidence is weak. Real evidence has to be checkable against a source neither party controls.
Here is how that works, and how anyone can verify a Klariqo call record in one command without logging into our system.
The vendor-dashboard illusion
Many providers claim their records are independently verifiable. What they usually mean is that you can log into their dashboard and their system will display a checkmark.
But that vendor operates the dashboard, maintains the database, and controls the clock. If the checkmark relies entirely on the vendor's own system, you are not verifying the evidence. You are trusting the vendor.
For a call center facing liability or a formal audit, that is a real weakness. The party with the most to lose in a dispute is relying on its own paid vendor to vouch for the evidence, and an auditor knows to discount that.
What real independent verification looks like
Real independent verification does not require trust. Two things make a call record checkable without contacting the vendor at all:
- A signature that proves integrity. The record is sealed with a digital signature. Recompute it and any change to the audio or transcript, even a single byte, breaks the check. This is math anyone can run, not a status the vendor reports.
- A timestamp from an outside authority. The record carries an independent RFC 3161 trusted timestamp, issued by a recognized timestamp authority, using the exact standard behind legal e-signatures. It proves the record existed at that moment and could not be backdated, and the proof comes from the authority, not from Klariqo.
How Klariqo secures the record
When a call ends, Klariqo secures the record in three steps:
- Seal and sign. The call data (the recording, the transcript, and the QA scorecard) is compiled into a single file on the open vCon standard, then cryptographically signed with Klariqo's published key (RS256), so any later edit is immediately detectable.
- Fingerprint. We compute a cryptographic hash of the signed file. Change a single letter of the transcript or one millisecond of the audio and the hash changes completely.
- Independently timestamp. We submit that fingerprint to an independent RFC 3161 timestamp authority (DigiCert), which returns a signed timestamp token. That token proves the record existed at that instant, signed by an authority outside Klariqo, so we have no power to backdate or fabricate it after the fact.
No transcript, audio, name, or phone number ever leaves your control in this process. The fingerprint reveals nothing about the call; it only serves as proof of integrity and timing when matched against the original file.
Step by step: how to verify a record
To verify a call, you hand an auditor, regulator, or client the evidence bundle. It is a single download that contains the signed vCon record, its DigiCert timestamp token, the authority's public certificate, and a one-page VERIFY-THIS-RECORD.txt with the exact command to run. They verify it themselves:
1. Check the signature and the timestamp
The reviewer runs the single command in the how-to (a standard openssl line) on their own machine. It recomputes the fingerprint, checks it against the signed record, and validates the DigiCert timestamp token against DigiCert's certificate.
2. Read the result
If the record is intact and the timestamp is genuine, the check prints Verification: OK. If anyone had altered the file, the signature would not match and the check would fail on the spot.
That is the whole process. It runs offline, on the reviewer's machine, against DigiCert's authority, with no Klariqo account, no login, and no Klariqo server anywhere in the trust path. If you prefer a browser, you can also drop the signed record into the public verifier at klariqo.com/vcon/, which confirms in your browser whether the record is intact and which key signed it, with nothing uploaded to us.
Why an independent timestamp, specifically
A trusted timestamp from an outside authority gives you two things a vendor's internal database cannot:
- No vendor trust required. The proof is issued and validated against DigiCert, an authority Klariqo does not run, so the reviewer does not need to trust Klariqo's database or servers.
- No backdating. The timestamp is set by the authority at the moment the record is sealed, so we cannot generate a record today and pretend it existed three months ago. In an audit, being able to show a record was not retroactively fabricated is worth a lot.
It is also the standard a lawyer already recognizes. RFC 3161 trusted timestamps are the technology behind legal e-signatures (eIDAS in the EU, ESIGN and UETA in the US, the signing under Adobe and PDF). Nobody has to be taught what it is.
Defining the evidence boundary
Precision is what makes evidence credible, so we are explicit about what this proves and what it does not.
- What it proves: this specific call record (audio, transcript, and scorecard) is genuine, unaltered, and existed no later than the trusted timestamp.
- What it does not prove: that a conversation legally took place, that the consumer gave valid consent, or that the call was lawful. It does not make your call center compliant.
The vCon record is your evidence of what happened on the call. The signature and the trusted timestamp are the proof that your evidence is real and was not backdated. Your scripts, your consent practices, and your legal review stay yours. A vendor claiming their software "makes you compliant" is overreaching, and a regulator will recognize the difference. We deliver the proof; you run your compliance program.
A real-world scenario
A mid-market call center runs 15,000 outbound dials a day. Three months after a campaign, a regulator requests the recording of a specific call to check a disclosure requirement.
Under the standard vendor-dashboard model, the manager logs into the dialer, downloads an audio file, and emails it. The regulator has to trust that the call center did not edit the recording, regenerate the file, or change the metadata.
Under the signed-and-timestamped model, the call center sends the evidence bundle. The regulator runs the one command in the how-to, sees Verification: OK, and confirms the record is unaltered and was timestamped three months ago, when the call happened. No trust in the call center's database or vendor is required. The proof is independent and checkable in minutes.
Comparison: standard vendor vs. signed-and-timestamped evidence
| Standard vendor-dashboard model | Signed + independently timestamped | |
|---|---|---|
| Proof source | Internal vendor database | A digital signature + an outside timestamp authority |
| Verification method | Vendor-controlled portal | One standard command, or any RFC 3161 tool |
| Login required | Yes, vendor credentials | No |
| Tamper detection | Relies on trusting the vendor's database | Cryptographic, any change breaks the check |
| Backdate protection | None, the vendor controls the clock | Fixed by an outside timestamp authority |
| Ultimate trust anchor | The software vendor | Cryptography and a recognized authority |
Frequently asked questions
Do I have to trust Klariqo to verify a record? No. The evidence bundle validates against DigiCert's timestamp authority and standard cryptography, on your own machine. No Klariqo login, server, or database is in the trust path.
Do I need any special software to verify a call?
No. The record is verified with standard tools (a single openssl command included in the bundle), or in your browser at klariqo.com/vcon/. No accounts, no proprietary apps.
What is an RFC 3161 trusted timestamp? An independent, cryptographic proof of when a record existed, issued by a recognized timestamp authority. It is the same standard behind legal e-signatures (eIDAS, ESIGN/UETA, Adobe/PDF signing), which is why it needs no explanation to a lawyer.
Does an independent timestamp make my outbound campaign compliant? No. It proves your call evidence is genuine, unaltered, and was not backdated. It does not validate consent or confirm a call was lawful. Managing consent, reviewing scripts, and legal procedures stay with your compliance officer and counsel.
Can third parties verify records without our cooperation? Yes. Given the evidence bundle, they run the whole check on their own. They do not need a Klariqo account, our permission, or our cooperation.
See the verifier in action
Test it yourself. Upload a sample record and watch verification happen entirely in your browser, with no data leaving your machine.