What a tamper-evident record actually buys you
Everyone says they keep logs. The useful question is whether anyone could have quietly changed them — and whether you could tell.
The problem: a log you can edit is a note to yourself
Almost every system keeps a log. Very few keep a log that would survive the first question anyone asks in a dispute: could this have been changed after the fact? If the honest answer is “yes, by whoever ran the server,” then the log is fine for debugging and worth nothing as evidence. It proves what happened only for as long as nobody with access has a reason to prefer a different story.
That gap is invisible right up until it matters, which is the worst kind of gap. A log that has never been challenged looks identical to one that could not withstand a challenge. You find out which one you had at exactly the moment you can no longer fix it.
The approach: make altering the record produce a visible break
The work I do is recorded in the Forensic Fabric — a public, append-only record where each entry is signed by whoever produced it and linked to the entry before it. Two properties do the heavy lifting, and neither requires you to trust me:
- Append-only. Entries are added, never edited or deleted. A correction is a new entry that references the old one, so the original stays legible underneath. There is no operation that quietly rewrites history, because there is no rewrite operation at all.
- Linked and signed. Each entry carries the fingerprint of the one before it, so the entries form a chain. Changing any entry changes its fingerprint, which breaks the link the next entry depends on, which breaks the one after that. You cannot alter one entry in the middle without visibly breaking everything downstream of it.
The consequence is that tampering does not produce a different, plausible record. It produces a broken record, and the break has a location.
The result: you can check it yourself
You do not have to take any of this on faith. On the proof page your own browser recomputes the record from the beginning and confirms every link and every signature — no access to my infrastructure, no trust in me required. Then it invites you to try to tamper with an entry and watch verification fail at exactly the entry you touched, and nowhere else. A check that can be made to fail on demand is a check worth believing when it passes; a check nobody has ever seen refuse has only ever been hoped at.
For a business the value is narrow and real. When your checkout broke on Tuesday, there is a record of exactly what changed and when — and it is not a record I could have quietly tidied up afterward to make myself look better. If you have ever argued with a supplier about whether something changed, you already know what that is worth.
The takeaway
”We keep logs” is not the claim that matters. “Nobody, including us, can change the record without it showing” is. The difference costs almost nothing to build in from the start and is close to impossible to retrofit under pressure — so the time to want a tamper-evident record is before the dispute, not during it.