How are records made tamper-proof?

What a seal is, in plain words

When a record is made, the system takes its exact contents and computes a fingerprint of them. Change a single character anywhere in the record and the fingerprint comes out completely different. That is the first half.

The second half is a signature over that fingerprint, made with a key your government holds. Anyone can check the signature. Only the holder of the key could have produced it. Together they answer two questions at once: these are the contents, and this is who sealed them.

Then each new record carries the fingerprint of the record before it. That is what turns a pile of sealed records into a chain, and it is why a record cannot be quietly removed from the middle of your history. Removing it breaks the link, visibly, at a named point.

1. The contents get a fingerprintA one-way computation over the exact contents of the record. Any change at all produces a different fingerprint.
2. The fingerprint gets signedSigned with a key your government holds, so the seal proves both what the record says and who sealed it.
3. The record links to the one before itEach record carries its predecessor's fingerprint, so the history is a chain rather than a pile.
4. Anyone can check the whole thingRecompute the fingerprints, verify the signatures, and walk the links. If anything was altered, inserted, or removed, the check names the exact record where it happened.

Built to still be provable in thirty years

Government records outlive technology. A guardianship record, an enrollment decision, or a council resolution may need to be shown in twenty or thirty years, long after every machine that touched it has been retired.

That is why records are sealed with cryptography chosen to withstand the kind of computers that do not exist yet. The concern is not hypothetical: information captured today can be stored and attacked later. A seal that is strong only against today's machines is a seal with an expiry date nobody wrote down.

There is a matching rule in how verification behaves. If a record carries one of these stronger seals and the software checking it cannot evaluate that seal, it refuses rather than passing. A check that could not be completed is never reported as clean.

The design rule is simple to state and hard to fake: a verification that cannot be completed must fail, never pass. Software that shrugs and says it looks fine is not proving anything.

Proof that does not require trusting the software

The strongest property of the whole design is that your government does not have to trust us to believe its own records. The sealed history can be exported and checked by an independent tool, on a machine that has never run our software, and that tool reaches its own conclusion.

This is what makes the record evidence rather than a report. Anyone can confirm it. Nobody has to take a vendor's word, including yours.

Questions tribes ask about sealed records

Can an administrator edit the history?

They can add a correction, and that correction is sealed and attributed to them like any other action. What nobody can do, at any level of access, is change a sealed record without the chain showing it.

What if we need to fix a genuine error?

You correct it. The correction is a new sealed record, the previous version is kept and remains readable, and the history shows both. Nothing is quietly replaced, which is the whole point.

Does this prove when something happened to an outside party?

It proves the order of events and that nothing was altered, sealed against keys your government holds. If a matter ever requires an independent time attestation from a third party, that is a further step and we will tell you plainly rather than imply the chain already does it.