For solicitors, compliance and finance teams
Business correspondence is the record most commercial decisions rest on, and it arrives carrying no evidence about itself. A message can be altered, forwarded, exported or composed from nothing, and ordinary practice has no way to tell those apart.
SelfCheck supplies the missing layer. It grades what a file is still capable of proving, tests only what the file can actually carry, and returns one of three answers with the reasons and the boundaries written out — together with a dated record and an audit trail a third party can check without taking our word for it.
What it does
You submit the email file you were given — an .eml, an Outlook .msg, or the raw source your client copied out of their webmail. What comes back is a record you can put on a file and hand to someone else.
First, how much of the transmitted message survives in what you were handed. Everything after this depends on the answer, and it is stated on the face of the assessment.
Where the file still holds the message as it was sent, the domain signature is verified against the key that domain publishes, and the result means what it says. Every file is graded before anything is tested, so a verdict only ever rests on evidence the file can actually carry. That grading is what makes a mismatch mean something when it is reported.
Where the holder of the original will supply it, every attachment is compared by cryptographic digest — which catches the substitution that reading the message never will.
One of three answers, the grade it rests on, the scope it covers, every limitation, the time it ran and the policy version it ran under. Shareable with a named third party for a period you set.
Every answer states exactly what it covers and what it does not establish, in the words you would use in a witness statement. That is more useful than a percentage, because it maps onto the claim you are actually making.
Read a complete anonymised assessment — grade, verdict, scope, limitations, timings and audit reference.
The case that costs money
Invoice redirection rarely looks like anything. It is a real thread, from a real supplier, with one attachment replaced — same filename, same apparent size, different bank details. Reading the message tells you nothing, because everything in the message is genuine.
Forwarded to your client
invoice-4471.pdf
111 bytes
8790a9619876e53ed31d536f146ae9af78118f2ad7e7ef19f514766528b12531
Held by the supplier
invoice-4471.pdf
111 bytes
b79d12d890e62e1d3da95b659594f4fcc69c2c90b1065a9066aab213d7a89c16
Asking a supplier or a client for mailbox access is a request most of them will refuse, and rightly. SelfCheck reads the forward for what identifies the message, works out which service holds it, and sends the holder the retrieval steps for that service — Gmail, Outlook, iCloud, Proton and the rest. They return one file. Nobody grants access to anything else, and nothing else is read.
A holder who has connected a mailbox can supply the original directly instead, under a permission they can withdraw at any time from their own email.
Grading
Every email is signed by the domain that sent it. That signature is computed over the message exactly as it left, and it is what ties the message to where it claims to have come from.
It survives almost nothing. Forwarding breaks it, and so does saving from Outlook, printing to PDF, or pasting into a witness statement. What reaches you is rarely the thing the signature was computed over.
Conventional tools run the test regardless. They verify, watch it fail, and report a failure — which turns an honest forward into something that reads like a forgery, and buries the real cases in noise.
Grading first makes the answer mean something. A file that cannot carry the question is identified as such, and the assessment says what would answer it instead.
The message as it was transmitted.
Still yieldsSignatures can be tested and a mismatch, if found, means something.
Recoverable structure with known, recorded losses.
Still yieldsSignals untouched by the loss still hold, and attachments can still be compared by digest.
Re-encoded or re-serialised — a forward, or an Outlook export.
Still yieldsAddressing, timing and attachment digests survive, and comparison against an original still settles a great deal.
A screenshot, a printout, or pasted text.
Still yieldsWhat it shows can be recorded and dated, and compared with a source if one is later produced.
The grade is on the face of every assessment. A firm that receives one knows immediately how much weight the file was ever capable of bearing, which is a question no verdict on its own answers.
The method
01
A signature that fails over an altered file is evidence about the alteration, not about the sender. Grading comes first, always, so that a reported mismatch is a fact about the message rather than about the journey it took.
A mismatch is asserted only over a source of sufficient fidelity to carry one.
02
Rely within this scope, inconclusive on this evidence, or do not rely — and beside it, what that covers, what it leaves open, and every limitation. A limitation that touches your claim turns a positive answer into a qualified one.
Scope is written in the language of a witness statement, which is the form the answer has to survive in.
03
A difference is named, and nothing beyond it. What the difference means is a judgement, and judgements belong to the person who is accountable for them.
A system fault is reported as a system fault, an unanswerable question as unanswered, and approval by a court or regulator is something the assessment never claims.
What is different about it
Signature verification is a settled, published standard, and implementations of it are widely available. What they share is an assumption: that the file being tested is the message that was transmitted. In professional practice that assumption almost never holds, because the file arrives after a forward, an export or a copy-and-paste, and each of those rewrites the bytes the signature was computed over.
The consequence is not a subtle one. A tool that verifies regardless produces a failure for the ordinary, honest forward, and produces the same failure for the genuinely altered message. Both look identical in the output, so the output cannot be used to tell them apart — which is the only thing the person holding the file needs to know.
SelfCheck puts a classification step in front of the verification step and binds the verdict to it. The artefact is graded for what it is still capable of establishing; the tests that the grade cannot support are declined rather than run and failed; and where nothing cryptographic survives, the assessment moves to comparison against a copy held elsewhere, which does not depend on the signature at all. The result is that a reported mismatch carries information, and an unanswerable question is returned as unanswered rather than as a failure.
That is a claim about design, and it is defensible in one sentence: the grade is recorded on the assessment, and the rules that map each grade to the tests it permits are published with the policy version that produced the answer. The sample assessment shows both.
Who carries the loss
Three categories of work turn on whether a piece of correspondence can be relied on, and in each of them the loss falls on a regulated professional rather than on the person who sent the message.
A supplier or conveyancing thread is intercepted and one attachment or one set of bank details is substituted. The firm that acts on it is the firm that carries the loss, and the question after the event is always whether the correspondence was what it appeared to be.
A party produces an email that the other side says was never sent, or was sent differently. The document is admitted or excluded on the strength of what can be established about the file itself.
Applications and regulatory responses routinely rest on correspondence supplied by the applicant, forwarded from a personal mailbox. The decision-maker has no way to test it and the applicant has no way to strengthen it.
This page states how these situations arise and nothing about how often. No figure, no case and no outcome is claimed, because none has been established to a standard worth publishing — and a number nobody can check is worth less than saying so. No client, logo or result is claimed either.
How it scales
Organisations are admitted one at a time, by a person reading the request. Slower on purpose — accountability starts with someone having looked, and the whole product depends on knowing who is asking.
That control is applied once, at admission. The assessment itself is fully automated: a submitted file is graded, tested and recorded without anyone touching it, and an admitted organisation gets a machine interface so its own systems can submit directly. A firm running a hundred assessments a week and a firm running three go through the same pipeline; only the first conversation is manual.
GET /api/v1 the contract itself, no token required
POST /api/v1/assess submit a message, receive an assessment
GET /api/v1/records list the assessments held by your workspace
GET /api/v1/records/{id} grade, verdict, scope, limitations, policy version
GET /api/v1/records/{id}/report.pdf the assessment as a filed document
POST /api/v1/records/{id}/grants issue a time-limited link to a named recipient
POST /api/v1/grants/{id}/revoke withdraw oneAccess
Full assessments, comparison against originals, time-limited sharing with named third parties, and a machine interface for automated intake.
Admitted one at a time, by a person reading the request. A request is normally answered within two working days.
Individuals can deposit a message while it is still intact, at no cost, so it can be examined later if it is ever disputed.
Verdicts are issued only to accountable organisations — an assessment nobody can rehearse against is the one that holds up when it matters. Submit, read the result, adjust, resubmit, and in time a forgery passes. It is a safety control, and it is not a price list.
A person reads every one of these, normally within two working days.