The cryptographic evidence chain — proof that survives the year-five review.
A cryptographic evidence chain is per-verdict compliance evidence signed at write time (Ed25519), RFC 3161-timestamped, hash-chained, and replayable byte-identically (target: five years) — verifiable with standard tools, by anyone, without trusting the operator. It is the substrate underneath acipta's audit-defensibility.
One chain across SOC 2, HIPAA, GDPR, EU AI Act & WCAG 2.1 AA.
Deterministic Precision. Experiential Intuition. Autonomous Agents.
Logs prove something happened. Evidence proves what it meant.
Most audit trails are logs: tamperable, not portable, and silent on whether a verdict can be reproduced. An evidence chain is built to be re-derived and independently checked.
Tamperable
Editable after the fact, hard to port, and they prove an event occurred — not the decision behind it.
Tamper-evident
Signed and hash-linked so any alteration breaks the chain; portable and verifiable offline.
Replay
The real bar: can the verdict be re-derived byte-identically later, by the platform alone? If not, it is trust-us, not evidence.
Sign at the source. Verify with standard tools.
acipta seals each verdict at write time and chains it so the whole record is independently verifiable years later — disclosed as an outcome, not a recipe.
Signed at write time
Every verdict is Ed25519-signed at the moment it is produced — not batched or reconstructed.
Timestamped + chained
RFC 3161 timestamps and a hash-linked ledger make the order and integrity provable.
Replayable, operator-independent
Re-derive against the pinned bundle with standard tools — no proprietary viewer, no trust in acipta required.
Cryptographic evidence chain — questions
Is this blockchain?
No. acipta uses standard cryptography — Ed25519 signatures, RFC 3161 timestamps, and a hash-linked ledger — not a distributed blockchain. The point is verifiability with standard tools, not a token or a chain of blocks.
Who can verify the evidence?
Anyone with standard cryptographic tools, offline, without a proprietary viewer and without trusting acipta as the operator. That independence is what makes it defensible.
What happens in 2031 when the engineer who shipped it is gone?
The verdict re-derives from the signed, pinned bundle — by the platform alone (target: five-year replay). Personnel turnover and model deprecation do not break the chain.
How is this different from collecting evidence on a schedule?
Schedule-based collection produces a point-in-time snapshot. A cryptographic evidence chain produces a per-verdict artifact, signed at the moment of the decision, that replays byte-identically later.
Evidence your auditor accepts in 2031.
Per-verdict, signed, replayable. acipta is the agent-based defensibility platform — workflow-grounded. Full GA August 23, 2026.