Skip to main content

Support Evidence

Support Evidence​

Support evidence packets collect display-safe account, security, commerce, and MFA context for a specific support task. They are meant to reduce risky back-and-forth, not to turn support tickets into raw log dumps.

Open a packet​

You need reporting access and the exact account or order from the support case.

  1. Open Awthy → Reporting → Commerce.
  2. In Support evidence lookup, select WordPress user or WooCommerce order.
  3. Enter the corresponding User ID or Order ID, then select Open evidence packet.
  4. Confirm the packet refers to the intended case before using its security summary.

For example, use the order ID already present in a checkout support request to review its recorded security evidence. Do not guess other customers' IDs. If lookup fails, check the ID and your access rather than sharing an unrestricted log.

Display-safe packets​

A support packet can include enrollment status, trusted-device metadata, passkey metadata, recovery readiness, recent security activity, and relevant audit references. It should use labels, timestamps, counts, hashes, and previews rather than raw secrets.

Never ask users to send passwords, authenticator codes, authenticator seeds, backup codes, recovery links, trusted-device cookies, OAuth tokens, payment data, or raw order payloads.

Commerce evidence​

Commerce evidence can summarize security-relevant checkout and order references, such as strong-auth assurance, checkout failure references, coupon usage references, and order/payment-token reference changes. It must not expose full payment details, raw order keys, addresses, or customer journey replay.

MFA attestation​

MFA attestation reports help show whether selected users or roles are enrolled and meeting the site's policy. Use them for internal review, support, or compliance evidence, not as a public certificate.

Support notes​

Support notes must stay scoped. Include what was checked, what action was taken, and which safe references support it. Do not include raw logs, secrets, full customer records, or private keys.

Last updated on