What does 'audit-grade PDF' mean for compliance?

An audit-grade compliance certificate is one an inspector can trust without taking your word for it. Four things make it so:

1. It is bound to its content. A hash of what was checked and found is recorded when it is issued, so any later change shows.
2. Anyone can verify it. A public address (Stratum's is stratumapis.com/verify/<reference>) confirms the certificate was issued, by whom, when and which checks ran, without showing the client's personal details.
3. It names its sources and their dates. Each list screened carries the date of the version used, so a check can be judged later against the list as it stood that day.
4. It is kept as long as the law asks. The Money Laundering Regulations 2017 (regulation 40) ask for due diligence records to be kept for five years after the business relationship ends, and then for the personal data to be deleted.

Why it matters: at an inspection, HMRC or your professional body asks to see the evidence for a particular client, sometimes years later. A screenshot of a search doesn't show what was checked or when. A certificate with a verify link does, and the inspector can check it themselves.

Every Stratum client check issues one. In the Stratum register it stays with the client until five years after you archive them; after deletion the verify page still confirms the certificate was issued, without any client details.