A local judgment you can recompute yourself.

Each finding describes what the file exposes, names common legitimate causes, and recommends the next evidence that could resolve the question. Ocolta does not collapse missing evidence into a negative verdict.

Deep Review is non-deterministic and may produce different or incomplete observations. It must keep fraud-risk indicators separate from AI-generation indicators and attach a page or region, observation, confidence, why the indicator may matter, a plausible benign explanation, and a proportionate next step.

Confidence applies to the reported observation. It is not a fraud probability, authenticity score, or statement about a person's intent. If the file is unreadable or materially incomplete, the appropriate result is unable to determine—not a forced conclusion.

Open Deep Review or compare its processing boundary.

Ocolta maintains two fingerprint databases. The genuine-format database records publicly observable conventions of authentic documents for the 20 institutions the guide library covers—12 banks (Chase, Bank of America, Wells Fargo, Citi, U.S. Bank, PNC, Truist, Capital One, TD Bank, Regions, Chime, Navy Federal) and 8 payroll providers (ADP, Gusto, Paychex, Workday, QuickBooks Payroll, Paycom, Paylocity, TriNet). Every trait is drawn from the published guide for that institution, so the database and the guides cannot drift apart, and every trait is hedged with “typically” or “commonly” because issuers change formats without notice.

The generator-signature database is deterministic and matches only PDF Producer and Creator metadata. It has exactly two confidence levels. High is reserved for metadata that names a document-generator tool in its own words—a Producer string containing “paystub maker” or “check stub generator”. Medium covers general-purpose HTML-to-PDF stacks (wkhtmltopdf, dompdf, TCPDF, mPDF, FPDF, jsPDF, WeasyPrint, PhantomJS, and the Chromium print pipeline). Template-generator sites commonly render with these stacks, and so do a great many legitimate businesses, so a medium match is always worded as a provenance question and never as an accusation.

Maintenance: fingerprint entries carry a version and a last-reviewed date, and are revised whenever the backing guide is revised. Where an institution has no single house format—Workday payslips are configured per employer, QuickBooks Payroll stubs are often deliberately plain—the entry says so, so that ordinary variation is not mistaken for a signal.

Deep Review+ adds one bounded research pass after the document review is complete. The model extracts institution-level entities from the document—employer, bank or statement issuer, payroll provider—and each one is checked in up to four ways: a public web-presence search for the organization name; a search associating the organization’s printed business address with its name; a public domain-registration (RDAP) lookup when the document prints the organization’s web domain; and a payroll ACH descriptor comparison against a published table of provider conventions.

Each entity is reported as corroborated, partially corroborated, not found, conflicting, or not researchable, with cited source links, a confidence level, and its own limitations. “Not found” means the automated pass located nothing—an inconclusive outcome. Small, new, family-run, and offline businesses routinely have no web footprint, and Ocolta will not convert that absence into an adverse inference.

Bounds: at most four entities and six searches per review, a search deadline independent of the model deadline, and a hard rule that a search-provider failure degrades the appendix to an honest “not researchable” rather than voiding a paid review. The document itself is never sent to the search provider.