Evaluation technical review

Fact sheet for production teams considering the free, unsigned Windows evaluation. This is developer-published documentation, not a security certification or independent audit. Last reviewed 10 October 2026.

1. Exact sample release

Edition: DeliveryProof 0.13.0-dev — Free Evaluation R2 (9 October 2026).

ZIP filename: DeliveryProof_FREE_EVALUATION_5_PACKAGES_20261009_R2.zip

Publisher-side local ZIP length: 17,261,378 bytes.

Publisher-side SHA-256: AD284D1C0AD92F9DA5196336A096D6292590B75C70C3EEBF93F42972126A8268

The ZIP was checked locally before upload, but the hosted Gumroad attachment has not been downloaded independently to establish its exact current server-side SHA-256. Verify it under your normal evaluation protocol; do not take the figure above as third-party proof.

Open the free evaluation

2. Runtime and bundled dependencies

• Application runtime and standard library: Python 3.14.7; GUI implemented with Tk/Tcl-Tk. Build packaging by PyInstaller 6.22.3.
• Local video metadata: bundled MediaInfo CLI / MediaInfoLib 26.10, invoked as a subprocess without a shell, with a 15-second per-probe timeout.
• Bundled components include MediaInfo.exe, LIBCURL.DLL, python314.dll, tcl90.dll, tcl9tk90.dll, VCRUNTIME140.dll, libcrypto-3.dll, libssl-3.dll, libtommath.dll, zlib1.dll, the relevant Python extension DLLs, and licensing notices.
• Package contains application, trial settings, quick-start documentation, timing worksheet and synthetic MP4 test media.

The full package inventory may vary by edition. Request the exact release inventory and verify the contents rather than assuming the Windows executable is standalone and signed.

3. Network activity and telemetry

In a developer source review, no customer-video upload or telemetry feature was found in the Python application implementation. Normal video-verification and ZIP operations are intended to run on local files. The runtime contains standard socket/SSL libraries and MediaInfo bundles LIBCURL.DLL, however, so no independent dynamic network-traffic audit or absolute absence-of-connections guarantee is claimed.

Gumroad's web checkout, account and email operations are separate from the downloaded desktop program. Test only in an environment your organization authorizes.

4. File handling and error boundaries

• Operator identifies a separately approved folder: DeliveryProof cannot authenticate that human approval or establish creative correctness.
• File checks include relative path presence, SHA-256 identity, and designated width/height, duration, average FPS and required audio-stream checks. Technical metadata is read from local files using MediaInfo JSON output.
• Path traversal, absolute/escaping paths, invalid or reserved Windows names, ambiguous case-insensitive collisions, symbolic links, junctions and other special-file cases are rejected in documented code paths.
• Unreadable files, incomplete scans, probe timeouts, malformed metadata or significant metadata mismatches must not produce a PASS-gated ZIP. Failed checks and NEEDS_REVIEW block the package.
• Declared duration comparison tolerance: 0.10 s; average FPS comparison tolerance: 0.01 FPS. Exact byte identity uses SHA-256.

Human verification of the actual files, video content and contract remains necessary. No subtitle text, language meaning, color grading, intellectual-property rights, broadcast-compliance or client-signoff validation is provided.

5. Windows compatibility and publisher trust

Publisher-side launch confirmed on Windows 10 Pro 64-bit (19045). Windows 11, enterprise policy environments, third-party antivirus compatibility, reproducible-build identity and independent penetration testing have not been verified.

The evaluation executable is not Authenticode code-signed. Never bypass SmartScreen, administrator safeguards or your company's endpoint security policy to run it. If your policy mandates a signed publisher or vendor security review, treat the product as currently ineligible until it meets that policy.

6. Suggested limited trial

1. Evaluate only with the bundled synthetic sample set, using your organization's approved test host.
2. Confirm that one changed or missing file blocks ZIP creation, and that the correctly matched sample permits packaging.
3. Record actual end-to-end time including baseline creation, correction, inspection and packaging; do not equate app-only execution speed to a net operational saving.
4. Make a purchase decision only after your independent validation. The evaluation allows five successful delivery ZIP packages.

Contact the developer for inventory, limitations or reproducible synthetic-test details. Do not email real customer footage or confidential media.