Evidence
Don't trust us — verify.
An auditor can download an evidence bundle and — with a ~250-line standalone CLI, no network, no database — recompute every leaf hash, rebuild the RFC 6962 Merkle root, verify the Ed25519 seal, and prove a single record's inclusion without seeing any other record. There is also a dependency-free browser verifier.
Break it yourself.
Below is a miniature four-record evidence bundle, hashed for real, in your browser, with the same construction the verifier uses (SHA-256 leaves and nodes, RFC 6962 prefixes). Click any byte of record 1's payload to flip it — then watch the leaf hash disagree, the mismatch climb the tree, and the seal break. Restore the byte and the bundle verifies again.
{"inv":"INV-2026-1044","total":"240000.00"}
Bundle verifies: every recomputed hash matches the sealed record.
The demo hashes with WebCrypto in your browser — nothing is sent anywhere. The production verifier does the same arithmetic over full bundles, plus the Ed25519 signature check and single-record inclusion proofs.
A bundle can't vouch for its own key.
The offline verifier treats a bundle's self-declared key as unpinned — not
independently verified, never as "authentic." To prove authenticity, an examiner
pins a key fetched out-of-band from /trusted-keys; only then does the seal prove
itself. Pin one you fetched independently, and the evidence stands on its own.
RFC 3161-capable: when a real timestamp authority is configured, its token is
cryptographically validated against your Merkle root — the token's own
message-imprint, not just a stored digest. The default TSA is a mock, and every
seal self-describes tsa_real:false, so nothing claims a timestamp it doesn't
have.
Security wrap The posture around the evidence
6-role RBAC
Six distinct roles with least-privilege boundaries — reviewers review, approvers approve, and nobody quietly does both.
PII tokenized first
Personal data is tokenized before any log line or evidence record exists — the evidence proves the invoice without exposing the person.
No existence oracle
Cross-tenant object requests return 404, not 403 — another tenant's records don't even confirm they exist.
CSP + security headers
Content-Security-Policy and hardened response headers on every surface.
SBOM (CycloneDX)
A machine-readable bill of materials ships with the software — you can audit what we run.
Signed artifacts
Release artifacts are signed; what you deploy is what we built.
Offline license check
License verification is offline with no phone-home — a sovereignty proof on its own.
Clean metrics
Prometheus metrics carry zero tenant identifiers — operability without leakage.
Authenticated retention & erasure
Even deletion is authenticated — at the end of the retention window, the sealed root's signature is verified before any evidence is destroyed. Nothing is erased off an unauthenticated field.
Hand your auditor the verifier, not a promise.
Every engagement ships with the offline CLI and a sample bundle on day one.