Verifiable Evidence Lineage

What tamper-evidence actually means here

Tamper-evident does not mean nobody can change the record. It means nobody can change it without the change being detectable. Each entry in your organization's governance history carries a SHA-256 fingerprint computed over the event and the fingerprint of the entry before it. That links every entry into one continuous chain. Editing, deleting, or inserting anything after the fact breaks the chain, and verification reports the exact point where the break occurs.

The nightly seal

Every night, each organization's completed day is closed into a single day root — one fingerprint that summarizes every entry recorded that day. Once a day is sealed, its root is fixed. Rechecking a sealed day means recomputing its root from the underlying entries and comparing: identical means untouched, different means something changed. You can run that verification at any time from the Evidence Lineage screen and see a pass or fail per day.

Fingerprinted evidence files

Every evidence file uploaded to RAIC is SHA-256 fingerprinted at upload and stored alongside its digest. That fingerprint is what proves the PDF an auditor is reading today is byte-for-byte the file your control owner attached months ago. If the file is replaced, the fingerprint no longer matches and the artifact is flagged rather than quietly accepted.

Honest labeling of older files

Evidence that predates fingerprinting is labeled unverifiable rather than presented as verified. This is deliberate: an auditor cannot fault you for evidence you labeled accurately, but they can absolutely fault you for evidence you overstated. Legacy history is repaired automatically on a weekly cycle, for every organization, with nobody pressing a button — lineage is rebuilt and older artifacts are fingerprinted going forward.

Reading the lineage graph

Lineage records the hops that connect a regulatory obligation to the person who signed off on it. Open Evidence Lineage from the Governance area to walk the chain end to end.

• Framework clause — the ISO 42001, EU AI Act, NIST, SOC 2, or CIS requirement being satisfied.
• Control — the control in your register that implements it.
• Test and result — the check performed and what it returned.
• Artifact — the fingerprinted evidence file that proves it.
• Signed pack — the sealed, signed bundle handed to the auditor.

Signed audit packs

A signed audit pack bundles the sealed day roots, artifact fingerprints, and lineage hops for a period you choose, along with a manifest signed using ECDSA P-256 with SHA-256. Downloads are named RhindonCyber_SignedAuditPack_<date>.json. Hand that single file to an examiner and they hold a self-contained, independently checkable record of your governance history for that period.

How an external auditor verifies a pack

Your auditor does not need a RAIC login, a trial, or a demo. They verify the pack against the public verifier at https://app.rhindoncyber.com/api/public/verify-evidence, or offline against the published public key. Verification confirms three things independently: the pack's manifest was signed by Rhindon Cyber, the day roots it contains match the entries it lists, and every artifact fingerprint is intact.

What gets recorded

Verification runs, day seals, lineage rebuilds, and pack signing are themselves recorded in your organization's activity log and mirrored to the platform log. The act of proving your history is itself part of your history — which is exactly what an assessor expects to see.

Availability

Verifiable Evidence Lineage is available to Enterprise organizations. Sealing, backfill, and fingerprinting run automatically once enabled; verification and pack signing are performed on demand by an Organization Administrator.