Guide for compliance, audit and engineering
Database log vs tamper-evident ledger
Almost every system that sells insurance keeps an audit log. Almost none of those logs could show that they have not been edited. That is not a flaw in any particular product; it is what a database table is. This page explains the difference in plain terms, using our own ledger as the worked example, and says what a ledger still cannot prove.
The ordinary case
What an audit log in a database is
A table with one row per event: who, what, when. It is genuinely useful, and it answers most day-to-day questions. Its limit is that every row is just data. Whoever can write to the database, whether an administrator, a support engineer, a migration script or someone restoring a backup, can change a row, delete one or insert one in the past, and the table afterwards looks exactly as if it had always been that way.
Logging the changes to the log does not help, because that second log is also a table. The record is as trustworthy as the least careful person with access to it, which is why a regulator or a court may treat it as your account of events rather than as evidence of them.
What changes
What makes a ledger tamper-evident
1. Each entry is sealed to the one before it
Every entry is reduced to a fixed text form and hashed with SHA-256, and that hash includes the previous entry’s hash. Change one premium in one old entry and its hash changes, so the next entry no longer links to it, and nor does anything after. The newest hash, the head, therefore stands for the entire history.
2. The database refuses to rewrite it
In our ledger, updates and deletions are refused by the database itself, for every role including the administrative one. That is prevention. The chain is what makes it more than a policy: if the refusal were ever bypassed, the chain would show it.
3. The head leaves the building
A chain only proves something against a head someone else already holds. Ours is published in a signed attestation that anyone can fetch and keep, and past heads are committed to the public verifier repository. Once you hold one, any later rewrite of the history before it is detectable by you, without asking us.
4. The head is signed
A signature means a head you saved cannot later be disowned as something we never published. You can check one in your browser on the verify page, or with the scripts in the public verifier.
Side by side
The same questions, asked of each
| Question | Audit table | Tamper-evident ledger |
|---|---|---|
| Can an administrator change an old entry? | Yes, silently | Refused by the database, and detectable if forced |
| Could an entry be inserted into the past? | Yes, silently | Detectable |
| Could entries be reordered or one removed? | Yes, silently | Detectable |
| Could the whole history be rebuilt from scratch? | Yes | Detectable against any head recorded beforehand |
| Can someone outside check it? | Only by trusting a screen or a copy | Yes, from an export, offline |
| Does it prove a quote that was never written? | No | No. A chain proves what is there, not what is missing |
| Does it prove when each entry was made? | No | An upper bound, once a head is timestamped. Our 13 September 2026 head is in Bitcoin block 967830 and later, so its entries existed before that block. The exact moment is still our word |
Trade-offs
What it costs you
Nothing in a ledger can be corrected, only followed by a new entry. That is the point, and it has a consequence: personal data must never go into it, because under the GDPR a person can ask for their data to be erased and an entry that cannot be changed cannot be erased either. Our quote entries have no field for a name, an email or an identifier for exactly that reason; the personal data you hold about a customer stays in your own system, where it can be deleted.
Scope
What this page is not
A technical explanation, not legal advice. Whether a given record meets a given obligation is for you, your counsel and your supervisor to judge. What we can offer is a record whose integrity you can check yourself, which is a better starting point for that judgement than one you have to take on trust.