Audit Log Service  ·  View 24 of 40  ·  5 · Runtime

Evidence Bundle and Offline Verification

Twelve messages, the last two of which involve nothing this organisation runs.

Editable source SVG draw.io All views
Compliance Officer Export Service Proof Service Confidential Ledger Ingest API External Auditor audit-verify CLI 1. export this result — matter reference 2. per-role export budget check 3. inclusion proofs for N records 4. leaf index + audit path per record 5. covering checkpoints for the range 6. signed heads + TSA tokens 7. manifest, watermark, HSM signature 8. record.export — who, what, how many 9. bundle + manifest digest 10. delivered out of band 11. audit-verify bundle --key published.pem 12. intact — no service was contacted Evidence Bundle — Verified by Someone Who Trusts Nobody Messages 11 and 12 involve nothing this organisation runs. The bundle is self-contained, the algorithm is published, the key is published and anchored, and the auditor's laptop is offline — which is the only configuration in which the verdict means anything. v 1.0 · owner Data & AI Global Practice · date 2026-09

Decisions

  • The bundle is self-contained: records, covering checkpoints, inclusion proofs, segment hashes and its own manifest, signed by a key whose public half is published.
  • The verifier is a single published binary with a specified algorithm, so verification happens on the auditor's machine with no network access and no trust in us. That is the only configuration in which the verdict means anything.
  • Every export is watermarked with the role and caller, recorded as an audit event, and counted against a per-role volume cap. Bulk export is the realistic exfiltration path for a store that is otherwise hard to attack.

What an auditor can ask

  • Proof of inclusion for a record: available now.
  • Proof of non-existence over a covered range: phase 3, on the absence filters — an auditor asks 'did this never happen?' as often as 'when did it happen?'.
  • Whether a gap is a deletion: answered by the tombstone and certificate, so the bundle verifies as lawfully disposed rather than as broken.

Assumptions

  • Bundles are delivered out of band — a secure file transfer agreed per matter, not a download link from this service. The service is not on the delivery path and is not asked to be.
◀  Verification All views Disposal  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source24-export-and-offline-verification