"Tamper-evident" is not "tamper-proof", and the difference is the point. No system can promise that bytes in storage will never change — anyone selling that is selling optimism. What a recorder can promise is stronger in practice: any change will be visible to whoever checks. Here's how that works, and what it looks like when the alarm actually goes off.
The mechanism, in one paragraph
Every event carries a fingerprint — a hash — of the event before it, forming a chain. Delete an event, and the link from its successor points at nothing. Alter one, and its fingerprint no longer matches what the next event recorded. Insert one, and it has no place in the sequence to claim. Whatever the tampering, the chain walk finds a link that doesn't hold — and unlike a promise, a chain walk is something an outsider can run themselves.
Who checks, and when
A mechanism nobody exercises is a brochure, so verification is wired into the product's routine rather than saved for emergencies. Rows on the tape carry their chain state as they're viewed. The anomaly engine walks recent chains continuously and raises its only critical-severity alert when a link fails. Evidence Pack generation re-verifies the period it covers. And the offline verifier lets an auditor repeat any of it without us. By the time a human asks "is this trail intact?", the question has already been answered many times, on a schedule, with the results on the record.
Where you'd actually see a break
Detection that lives in a white paper is worthless, so break reporting is threaded through the product in three places. Each agent's row shows its chain state — tamper-evidence as a per-actor answer, not one global health light. The data integrity view walks the chains and lists any breaks with their context: which records, which neighbourhood, when. And the executive summary of every Evidence Pack counts broken-chain agents — a number which, if non-zero, will rightly halt evidence acceptance until it's triaged. The recorder reports its own bad news in the same report it hands your auditor. It has to, or the good news would be worthless.
Just as important: not crying wolf
A tamper alarm that produces false accusations trains everyone to ignore it, which is worse than no alarm. Two design choices guard against that. Events are verified in the model they were recorded under — capture paths differ, and a record is checked against the chain semantics of its own source rather than someone else's. And a capture path that genuinely carries no chain says so, plainly, on every affected record: labelled chainless, never accused of breaking a chain it was never part of. Honest labels are what keep the red flag meaningful on the day it matters.
When the alarm fires
A real break is not a philosophical event; it's a worklist. The break names its location — the records on either side, the agent, the window — so the investigation starts from "what happened between these two points" rather than from zero. Maybe it's an operational incident; maybe it's the day the whole product pays for itself. Either way, you know, you can show when you knew, and the evidence of the anomaly is itself preserved — which converts even a bad day into a demonstrable process: detected on this date, investigated by this person, resolved with this outcome. Regulators forgive incidents; they don't forgive not knowing.
What the chain doesn't catch — and what does
One honest boundary completes the picture: a hash chain detects modification of what was recorded. It cannot detect an event that was prevented from being recorded at all — a missing event leaves no broken link, because it leaves nothing. That gap belongs to a different mechanism: reconciliation, where independent counters — what was ingested, what was stored, what was archived — are compared continuously, and drift surfaces as an anomaly. Chain plus reconciliation covers both halves of the tampering problem: changed history and suppressed history. Vendors who only mention the first half are leaving you to discover the second one during an incident.
Detection is the auditable property
Prevention systems ask you to trust that nothing bad could have happened. Detection systems let you demonstrate that nothing bad did — or show precisely where something did and what you did about it. Only one of those is an argument an auditor can check. That's why the chain, like the signature, is built for outside verification rather than inside reassurance.
Questions about chain verification against your data? Ask us.