Records & audit

Signed, immutable records · WORM-stored (S3 Object Lock, 5-year retention) · hash-chained audit.

Audit chain intact

Records

append-only · per-firm isolated

ID	Record	Kind	Status	Date	Hash

Record verification

REC-2041

Advice record — client MC-0142 · verified against the database and the write-once copy.

Stored document matches its recorded hash	✓ pass
Signature is valid (KMS RSA-3072)	✓ pass
Content matches the database	✓ pass
Stored PDF matches its recorded hash	✓ pass

Record hash: sha256:9c2f00…a7b1
Store URI: s3://qpe-records-worm/meridian/ia_advice/REC-2041.json
Signing key: arn:aws:kms:ap-south-1:…:key/qpe-sign-rsa3072

Audit chain

✓ intact

Entries1,284since firm onboarding

StructureHash-chainedeach entry seals the previous

Last verified2 min agofull re-walk

Every record, approval and verification is written as an append-only audit entry whose hash includes the hash of the entry before it. Re-walking the chain recomputes each link, so any insertion, deletion or edit breaks the chain and is detected. Entries are per-firm isolated (Postgres row-level security) and cannot be removed.

Chain head: sha256:e0b7c4…1d9f

Indicative, not advice. Prototype — no real records are stored or signed.