Why audit logs aren't enough
Most compliance platforms keep a log of what happened and when. That's a start — but a log that can be quietly edited after the fact isn't evidence. It's a record of what someone says happened.
In regulated industries — construction, infrastructure, energy — a compliance record may need to stand up in court, satisfy an HSE inspector, or survive a client audit. The question isn't whether you have a log. The question is whether you can prove it hasn't been tampered with.
What hash chaining does
Hash chaining borrows a concept from blockchain without the overhead. Every entry in the audit log includes:
- The event data (who did what, when, to which record)
- A SHA-256 hash of the previous entry
This creates a cryptographic chain. If any entry is modified, deleted, or reordered, the hash of every subsequent entry becomes invalid. The chain breaks — and the break is mathematically provable.
How ComplicEdge implements it
When a compliance event occurs — a certificate is issued, a worker record is updated, a Subject Access Request is completed — the system:
- Records the event with full actor attribution (who), entity reference (what), UTC timestamp (when), and a canonical JSON representation of the changes
- Computes a SHA-256 hash over the event data combined with the previous entry's hash
- Appends the entry to the tenant's audit chain
Entries are append-only. There is no update or delete operation on the audit log — by design.
Why canonical serialisation matters
A subtle but critical detail: JSON objects don't guarantee key order. The same data serialised twice could produce different byte sequences, which would produce different hashes. ComplicEdge uses canonical serialisation (sorted keys, deterministic formatting) so that the same logical data always produces the same hash. Without this, chain verification would fail on valid data.
Independent verification
The chain can be verified by anyone with access to the raw entries. You don't need ComplicEdge software to check it — any tool that computes SHA-256 hashes can walk the chain and confirm integrity. This is deliberate. The value of a tamper-evident log depends on it being independently verifiable, not just self-certifying.
What this means in practice
When an HSE inspector asks for your compliance records, you don't hand over a spreadsheet and hope they trust it. You export a verified, hash-chained audit trail where:
- Every entry is linked to the one before it
- Any modification is detectable
- The chain's integrity is independently confirmable
That's the difference between claiming compliance and proving it.