Support Evidence

Last verified: 2026-07-08

Support evidence packets collect display-safe account, security, commerce, and MFA context for a specific support task. They are meant to reduce risky back-and-forth, not to turn support tickets into raw log dumps.

Display-safe packets

A support packet can include enrollment status, trusted-device metadata, passkey metadata, recovery readiness, recent security activity, and relevant audit references. It should use labels, timestamps, counts, hashes, and previews rather than raw secrets.

Never ask users to send passwords, authenticator codes, authenticator seeds, backup codes, recovery links, trusted-device cookies, OAuth tokens, payment data, or raw order payloads.

Commerce evidence

Commerce evidence can summarize security-relevant checkout and order references, such as strong-auth assurance, checkout failure references, coupon usage references, and order/payment-token reference changes. It must not expose full payment details, raw order keys, addresses, or customer journey replay.

MFA attestation

MFA attestation reports help show whether selected users or roles are enrolled and meeting the site's policy. Use them for internal review, support, or compliance evidence, not as a public certificate.

Support notes

Support notes must stay scoped. Include what was checked, what action was taken, and which safe references support it. Do not include raw logs, secrets, full customer records, or private keys.