Mathematical, not procedural.
Most "audit trails" are append-only because the application says so. Ours is append-only because the database enforces it, hashed because cryptography enforces it, and verifiable because the public chain anchors it.
Hash-chained audit ledger
Every ledger entry stores hash = SHA-256(seq + ts + prev_hash + payload).
Editing entry N requires rewriting every subsequent entry — and even that won't match the Merkle anchor.
seq=1 prev=0000... hash=55a1934a701e5970e4bcde96a7429540d2250422f338ff01b88785c7bc75773f
seq=2 prev=55a1... hash=5e73b2c4138979c77cf18197cc7702a84e34440eb79b0a28ef0762a1e2f52cb3
seq=3 prev=5e73... hash=…ECDSA P-256 signatures
Each party (sender, receiver, witness) signs the handover payload with their private key. Private keys never leave the device — on web via Web Crypto, with Secure Enclave / TEE and WebAuthn / Passkeys on the mobile roadmap.
On the roadmap: server-side public-key registration and signature verification, binding each signature to a verified identity.
Merkle anchoring
Every 10 ledger entries are reduced to a Merkle root. Once that root is anchored to an external, independent record, even a privileged admin who tampered with their own database can't change history without contradicting the published root.
On the roadmap: the current release computes and stores Merkle roots; external anchoring (an RFC-3161 timestamp authority and/or a public chain) is being wired so the proof holds even if our database is lost.
Privacy-preserving federation
Peer organisations share salted SHA-256 commitments of banned actors rather than names. A query — "is this actor banned somewhere?" — is answered against the commitment set, so partners learn that someone is blacklisted without exchanging the underlying PII or the reason.
On the roadmap: a fully oblivious private-set-intersection protocol for cross-org checks as the network grows beyond a single operator.
Audit-grade evidence bundles
When fraud is detected, you export an integrity-sealed bundle (HMAC-SHA256) tied to the hash-chained ledger — strong supporting documentation for insurance adjusters and investigators.
Every export is also logged to the ledger. The watchers are watched. On the roadmap: asymmetric (publicly-verifiable) signatures and accredited timestamping, so bundles meet the bar for formal legal admissibility.
Compliance
We design to align with these frameworks — they are our compliance targets, not third-party certifications. A Data Processing Agreement (DPA) is available on request; an independent penetration test is on our roadmap.