Proving nothing changed

The tamper-evident log

Every change is recorded in a chain of fingerprints. Editing or removing an entry breaks the chain.

How the chain works

Each entry in your log contains a fingerprint (SHA-256) of the change and of the entry before it. Change anything in an old entry and its fingerprint no longer matches; the check fails and says exactly which entry broke. Each account has its own chain.

What the check catches

• Edits: any changed field breaks that entry.
• Reordering: entries no longer point at the one before them.
• Removing the newest entries: note the latest fingerprint (the “head”) somewhere safe; if entries are later removed, the head no longer matches.
• Moving entries between accounts: the account is part of each fingerprint.

Where it came from

When you save a fact you can say where it came from. That source is stored as written and the memory is labelled as having a declared source. Without one it is labelled unverified. These are labels, not a judgement of truth: a declared source can still be wrong.

What it does not prove

The chain proves a record was not changed afterwards. It does not prove the person who wrote it was honest. Whoever runs the database could rebuild the whole chain, which is why you should keep your own copy of the head, or your own signed export.