Architecture

Capture at the edge.
Chain on arrival.
Prove on demand.

Three properties do the work. The interaction is recorded where it happens. The record commits to everything before it. The content can be separated from the proof. Everything else follows from those.

Data flow

From a keystroke to an attestation.

On the device: redaction happens here
CollectorBrowserPrompts, replies, uploads, artifacts
CollectorGatewayServer-side model calls
CollectorAgent hookCoding agent runs
CollectorLocal proxySelf-hosted inference
↓   redacted event + content hash   ↓
IngestAuthenticate & scope Token verified by hash; the sources it may submit are enforced before anything is written.
IngestPolicy evaluation Your rules run at write time, attaching findings and flagging what needs review.
IngestChain append One lock per batch, hashes computed in sequence, head advanced without rewind.
StorageEvent chainThe proof. Immutable, append-only, hash-linked.
StorageContentRedacted bodies, own retention, DSAR-deletable.
StorageBlobsFiles and previews, own retention, DSAR-deletable.
OutputConsoleExchanges, people, findings, coverage
OutputSigned attestationVerification report for an auditor
OutputSubject packetEverything held about one person
OutputExternal anchorHead hash witnessed off-database
The chain

Why one altered record breaks everything after it.

Each event's hash is computed over its own canonical contents and the hash of the event before it. That single dependency turns a list of rows into evidence.

# each event commits to its predecessor seq 41 hash = sha256( canonical(event 41) ‖ hash(40) ) seq 42 hash = sha256( canonical(event 42) ‖ hash(41) ) seq 43 hash = sha256( canonical(event 43) ‖ hash(42) ) ▲ edit event 41 and this no longer matches. Nor does 43, 44, 45 … all the way to the head.

Canonical, not incidental

The hash is taken over a canonical form with keys in a fixed order, so the same event always produces the same hash however it was serialized. Two independent implementations agree. That is what lets an auditor re-verify with their own code.

Attachments are attested, not embedded

A file's SHA-256 is covered by the event hash, but the bytes live elsewhere. So evidence that a specific file was uploaded survives the file's own deletion. The hash still proves what it was.

Appending is serialized per tenant

Each batch takes the chain head lock once, so concurrent collectors cannot interleave into an ambiguous order. A partially written batch never commits. A gap in the sequence would break verification permanently.

Verification names the break

Re-verification tells apart three things: a record whose content was altered, a link severed by a removal or reorder, and a gap in the sequence. It reports the sequence number and event id for each.

Anchoring

A chain that only checks itself proves less than you think.

An intact chain proves nobody made a careless edit. On its own it does not stop an attacker with database write access from rewriting the whole history, recomputing every hash as they go, and leaving something that verifies perfectly.

Anchoring closes that gap. Chain heads are published periodically to storage outside the database. An attacker rewriting history would have to reach the witness too. If they cannot, the mismatch gives them away.

What the console tells you

An unanchored ledger is reported as self-consistent but unwitnessed, rather than as a green tick. For an evidence tool, overstating the guarantee is about the worst thing you can do.

Retention & erasure

Delete the content. Keep the proof.

A data-subject erasure and a tamper-evident audit log are usually in direct conflict. Keeping content outside the chain is how that gets resolved.

ActionRemovedKeptChain
Retention sweepPrompt bodies and file bytes past their periodEvent rows, hashes, findingsIntact
Subject erasureAll content and files for that personEvent rows proving the interactions happenedIntact
Attachment policy: preview onlyOriginal bytes, never storedRedacted preview, filename, size, hashIntact
Attachment policy: metadata onlyAll bytes, never storedFilename, size, SHA-256Intact

Erasure is admin-only. It needs a typed confirmation and a written reason, and it is recorded in the administrative audit trail. The act of deleting evidence is itself evidence.

Running it

What you operate.

Control plane

A console and ingest service. Runs on-premises, in your own cloud account, or as a service we operate. See deployment.

PostgreSQL

One database holds the chain, content, blobs and identity graph. Your backups, your encryption at rest, your region.

Collectors

A browser extension deployed by policy, plus whichever server-side collectors match how your teams call models.

External anchor

A small store outside the database for chain heads. Deliberately somewhere your database administrators cannot write.

Next

See it against your own question.

Bring the thing you cannot currently answer. A walkthrough is more useful when it has to survive a real question.