Audit-Grade Compliance Records
Aegis Firma compliance records are tamper-proof by design — not by policy. This page explains the architecture and lets auditors independently verify the integrity of any organisation's records.
Verify a specific organisation
Append ?org=YOUR_ORG_ID to this URL to generate live Merkle root hashes for that organisation's records. Share this URL with auditors — they can recalculate at any time to verify integrity.
Tamper-Proof Architecture
Append-only database triggers
PostgreSQL-level triggers reject any UPDATE or DELETE on compliance records, usage logs, and incident reports. Modifications are impossible — not just policy.
Technical detail ▾
BEFORE UPDATE/DELETE triggers raise EXCEPTION at database level, before any application code runs.
Merkle tree record hashing
Every set of compliance records can be reduced to a single Merkle root hash. Any tampering with even one record changes the root — detectable in seconds.
Technical detail ▾
SHA-256 binary tree. Odd node duplication at each layer. Deterministic for identical record sets.
Row-level security isolation
Supabase Row Level Security policies ensure each organisation only accesses its own records. No cross-tenant data leakage is architecturally possible.
Technical detail ▾
RLS policies checked server-side on every query. Even administrative queries from app code cannot bypass RLS.
Immutable audit timestamps
All timestamps use TIMESTAMPTZ NOT NULL DEFAULT NOW(). No application code can write a timestamp — the database clock is the only authority.
Technical detail ▾
No updatable timestamp columns. detected_at / completed_at / created_at all set by NOW() at INSERT time.
What auditors can independently verify
EU AI Act
Art.17 (Quality Management), Art.19 (Logging), Art.72 (Post-Market Monitoring)
GDPR
Art.5(f) (Integrity & Confidentiality), Art.25 (Data Protection by Design), Art.32 (Security)
ISO 27001:2022
A.8.15 (Logging), A.8.17 (Clock Synchronisation), A.5.36 (Compliance with Policies)
Aegis Firma Audit Badge · Generated Wed, 09 Sep 2026 09:01:26 GMT · aegisfirma.com