Step 01
Step 1
Every admin or partner write lands on an HMAC-chained log row.
ComplianceRetail + B2B· marketing-claim · audit-hmac-chain
Hash-chained audit trail.
Every admin write and every partner write is HMAC-chained — tamper-evident at scale.
The problem
Why this exists.
An audit log you can edit is not an audit log. Most production systems treat write-once as a vendor promise rather than a structural property.
We want every consequential action — admin pause, partner approval, consent change, model override — bound to the previous one so a tampered row breaks the chain at verification.
How it works · 3 steps
From input to outcome.
- Step 02
Step 2
Each row binds the prior HMAC, so any tampered row breaks the chain at verification.
- Step 03
Step 3
Operators query the chain from the admin tooling; partners see their own writes in the portal.
Under the hood
The models and routes behind it.
Models called
No models cite this feature directly — backing logic is deterministic Python.
API routes
Internal-only — no public route handler.
Compliance posture
- Topology is HMAC chain (not a Merkle tree); chain-break is detectable by replaying any window.
- DPDP §12 — your account erasure preserves the chain structure while removing your identifiers.
- Grievance under DPDP §13 — [email protected].
What it's not
Hash-chained audit makes tampering detectable, not impossible. Operators with sufficient access still write rows; the chain ensures no one can silently rewrite history.
Related · features & stories