A tamper-proof audit trail: the traceability auditors demand
In regulated distribution, keeping a record isn't enough: you must prove it hasn't been altered. Here's the difference between an editable log and a truly tamper-proof one — and why it's now built into SupplyCore.
"Append-only" doesn't mean tamper-proof
Most software shows an "audit trail": who did what, when. Useful — but it doesn't answer an auditor's real question: how do you know this log wasn't modified after the fact?
An "append-only" log (you only add at the end) is often still editable at the storage layer: a row can be rewritten, deleted or reordered by anyone with database access — with nothing to show for it. For a pharmaceutical or petroleum audit, that gap alone can invalidate the whole trail.
The property the frameworks (21 CFR Part 11, GMP, ISO 27001) actually require isn't "we don't delete" — it's detectability: if someone alters history, it must be provable.
Cryptographic chaining, explained simply
SupplyCore now chains every audit entry. Concretely, each event (price change, credit issued, stock adjustment, login…) carries three elements: an increasing sequence number, the fingerprint of the previous entry, and its own SHA-256 fingerprint computed over its content + the previous fingerprint.
It's the same principle as a chain of welded links: each link contains the previous one's fingerprint. Change an entry's content, and its fingerprint no longer matches. Delete one, and the next link points to nothing. Reorder them, and the sequence breaks.
The result: you can still read history, but you can no longer quietly rewrite it. Any tampering — modification, deletion, insertion, reordering — leaves a mathematically detectable mark.
One-click integrity verification
At any time, an administrator can run a verification: SupplyCore recomputes the entire chain and confirms — or not — that nothing has been altered. If there's a break, it points to exactly where (which sequence, which kind of anomaly).
This isn't a marketing report: it's a reproducible cryptographic check. An external auditor can rerun the same computation and reach the same conclusion. That's what an integrity proof is.
The one-click "audit-ready" file
Preparing an audit used to take days: gathering logs, cross-referencing movements, formatting evidence. SupplyCore assembles it all in one click, for any period you choose: the tamper-proof log, the integrity verdict, aggregates by module and action, exportable to PDF, CSV or XML.
The file is ready to present to Health Canada, the FDA, Transport Canada, an ISO auditor or a corporate customer. And because security must be consistent, the export itself is logged — who generated which file, when.
What this changes for your sector
Pharmaceutical — lot/date traceability becomes audit-defensible: the integrity of history is provable, a prerequisite in the spirit of 21 CFR Part 11 and GMP.
Petroleum and dangerous goods — in case of a spill or incident, the timestamped, tamper-proof registry is ready to present to Transport Canada or the environmental authority, with no grey area about possible edits.
All sectors — for ISO 27001, access control and logging whose integrity is verifiable directly strengthen your certification file. Formal compliance still depends on your procedures — but the tool provides the technical evidence.
Want to see integrity verification and the audit-ready export on data representative of your sector? Request a demo.