When digest-only mode is the default
Most projects default to digest-only for privacy. Receipt stores content_hash; raw text is not retained on our servers.
Why digest-only
Reduces exposure if the receipt store is breached. Reduces storage cost. Satisfies most audit needs (you can prove the content existed and prove what wasn't tampered with) without storing the content.
When to use full-content mode
Specific compliance use cases where the audit value IS the content (e.g. legal discovery, regulator review of specific AI decisions). Per-project opt-in.
Verification flow
The receipt holder still has the raw content; they can re-hash and compare against the receipt's content_digest to verify integrity locally.