The sitewide lead page, so the form comes first. Every page's offer band and secondary button lands here. Visitors arriving from those buttons have already decided they want the pack, so the form sits in the hero, above the fold. The rest of the page previews the four documents for anyone who wants to see before leaving an email.

Before launch, produce the pack from an anonymised real Agentic Verification run. The page promises "a real run"; until the pack exists, it can't go live. The previews further down use the site's fictional example values and say so.
Four fields, as on the Agentic Verification page: first name and company for routing, work email to send the pack, and "I'm a" to qualify the lead.
The submit button uses the exact secondary CTA label, so the action reads the same from every page to the form.
In production this is a HubSpot form that emails the pack. Legal should confirm the consent wording. No offer band on this page.

Sample evidence pack

See exactly what your auditor would receive.

Four documents from a real Agentic Verification run, anonymised. Judge the evidence before you talk to us.

Recoverability Certificate: proof the deposit builds
Run report: every step of the rebuild
SBOM excerpt: what's inside the software
Exit workbook excerpt: how you would exit, step by step

Rather see it on your own applications? Book a demo.

Trusted by 3,500+ teams
ISO/IEC 27001:2022 certified
Own models, no third-party AI

Where should we send it?

First nameEnter your first name.

CompanyEnter your company.

Work emailEnter a work email, like name@company.com.

I'm a

This is where the pack would go out.

This is an example page, so nothing was sent. In production, this form submits to HubSpot and emails the pack straight away.

Social proof straight after the promise. These are the logos production already uses, loaded from codekeeper.co. Where an image can't load (for example in the preview), the name shows instead. Use the approved set only.

Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors

Step 4, the proof: show the deliverable before asking for an email again. The tabs are adapted from the Agentic Verification page (Certificate, Run report, SBOM), plus a fourth tab for the Exit workbook, which is in the pack. The run report shows a missing package being flagged and added, which is the most persuasive moment in any run. The certificate keeps the agreed line: it documents the rebuild and doesn't grant release rights. Every preview is labelled as example values; swap in excerpts from the real anonymised pack once it's produced.

What's inside

Four documents. One rebuild behind them.

Every Agentic Verification run adds to a dated record of what was tested and when. The pack shows you one complete set.

CodekeeperRecoverability Certificate

ApplicationPayments Core

Run#11 · Agentic Verification

ResultPassed

Vendor helpNone

Date3 September 2026

Isolated rebuild completed

Build steps documented

SBOM generated

Exit workbook updated

Example certificate with fictional values. It documents the rebuild and its result. It doesn't grant release rights; those come from the agreement.

Software bill of materialsPayments Core · Regenerated by run #11 · 3 Sep 2026

412 components38 direct374 transitive

Component	Version	Type	Licence
spring-boot-starter-web	3.3.2	Library	Apache-2.0
jackson-databind	2.17.1	Library	Apache-2.0
ledger-core	4.2.0	Private package	Proprietary
postgresql (JDBC)	42.7.3	Library	BSD-2-Clause
react	18.3.1	Library	MIT
pdf-render-sdk	9.1.0	Licensed component	Commercial

Showing 6 of 412 components

Example SBOM. Component names other than the open-source libraries are fictional.

Get the sample evidence packFour documents, anonymised from a real run

Recoverability Certificate

A dated record that AI agents rebuilt the deposit in a sealed sandbox, with no help from the vendor, and what the result was.

Run report

Every step the agents took, with timings, and anything that was missing, flagged and added.

SBOM excerpt

The components the build needed, with versions, types and licences, regenerated with every run.

Exit workbook excerpt

The recovery process, step by step, written from a rebuild that worked.

What each document proves, and which file it supports. Risk and compliance leads want to know where a document goes before they ask for it. The table says what each one proves in plain terms and names the file it supports, using the agreed wording ("evidence for your DORA Article 28 or PRA SS2/21 file"), never "compliant".

Quotes: I checked PRA SS2/21 paragraph 10.10 against the Bank of England PDF (November 2024 update). The DORA Article 28(8) quote is the verified string from the messaging brief; EUR-Lex couldn't be read in full from here. Legal should review both quotes and the disclaimer before launch.
Left out on purpose: CRA and NIS2 mappings for the SBOM. They'd help vendors, but I couldn't verify the article text against EUR-Lex, so they wait until someone has.

For your file

What each document proves, and where it goes.

Regulators now ask whether you could leave a supplier and keep running, and what evidence you hold. Each document answers part of that question.

Document	What it proves, and the file it supports
Recoverability Certificate	The deposit builds. AI agents rebuilt it in a sealed sandbox, with no help from the vendor, on a stated date. It documents the rebuild; it doesn't grant release rights.DORA Art. 28 filePRA SS2/21 fileDated evidence that the rebuild has been tested, not just planned
Run report	How the rebuild ran: each step, its timing, and anything missing that was flagged and resolved.DORA Art. 28 filePRA SS2/21 fileThe detail behind the certificate, for an assessor who asks how
SBOM excerpt	What's inside the software: the components the build needed, with versions, types and licences.DORA Art. 28 filePRA SS2/21 fileThe third-party components you'd depend on after an exit
Exit workbook excerpt	How you would exit: the recovery process, step by step, written from a rebuild that worked.DORA Art. 28 filePRA SS2/21 fileA documented exit plan, kept current with each rebuild

EUDORA

“Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.”

Regulation (EU) 2022/2554, Article 28(8)

UKPRA SS2/21

“Firms' exit plans should cover stressed exits and be appropriately documented and tested as far as possible.”

PRA Supervisory Statement SS2/21, paragraph 10.10

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.

See evidence by regulation

Steps 3 and 4: where this evidence comes from, and what sits either side of it. The pack shows the middle rung of the proof ladder. Placing it on the ladder answers "which plan gives me this?" and shows the next step up (the Exit Exercise) without a hard sell. The prices are the 6 Oct list. The note keeps the base tier strong: Escrow and Resilience are complete protection with their own certificate.

The proof ladder

The pack shows the middle rung.

Every protection comes with evidence. The higher you go, the more it proves.

Every protection

Software Resilience Certificate

The deposit is held, and an automated check confirms what's in it, with a vault report.

Proves: it's there.

In this pack · Escrow Pro, Resilience Pro, Continuity

Recoverability Certificate

AI agents rebuild the deposit in a sealed sandbox, in hours, four times a year. With a run report, an SBOM and an Exit workbook.

Proves: it builds. Agentic Verification

Add-on to any plan

Tested Exit Report

Our specialists rebuild by hand in a clean room and test the business functions you nominate, without the original developers.

Proves: you could exit and keep working. Exit Exercise

Agentic Verification is included in Escrow Pro (from $449), Resilience Pro (from $649) and Continuity (from $1,449), per application per month. Escrow (from $199) and Resilience (from $399) are complete protection too, with a Software Resilience Certificate. See all prices

Questions people ask before they hand over an email. Is it real, who is it for, what happens next. The follow-up answer matches the consent line on the form, so the page makes one promise about email, not two. The release-rights answer uses the agreed wording.

Questions

About the pack.

Is this from a real run?

Yes. The pack is made from the outputs of a real Agentic Verification run, anonymised so the customer, the application and the code can't be identified.

Who is it for?

Anyone who needs to judge the evidence: risk, audit and compliance leads checking what they'd file, customers comparing protections, and software vendors preparing for a customer's due diligence.

What happens after I ask for it?

We email you the pack. We may follow up once about Agentic Verification, and you can unsubscribe at any time.

Does the Recoverability Certificate grant release rights?

No. It documents the rebuild and its result. Release rights come from your agreement.

Can I see this for one of our own applications?

Yes. Book a demo and we'll show you how a rebuild would run on your application. With Escrow Pro, Resilience Pro or Continuity, you start rebuilds yourself, four times a year, on supported technology stacks.

Where are the Software Resilience Certificate and the Tested Exit Report?

The pack focuses on Agentic Verification. Escrow and Resilience include a Software Resilience Certificate, and an Exit Exercise produces a Tested Exit Report. We can show you both on a demo.

The same close on every page. On this page the second button scrolls back up to the form instead of reloading the page. Every page ends on the same two actions in the same order: Book a demo, then the sample evidence pack.

Know it builds before you need it.

Get the sample evidence pack now, or see Agentic Verification on one of your own applications.

Book a demo Get the sample evidence pack