Change one temperature. Watch the record break.
A paper logbook can be filled in after the fact in ten seconds. This cannot. Edit a reading below and every fingerprint after it stops matching — the same check an inspector runs on a link you send them.
What a signed record is
Three ideas, and none of them need any cryptography to follow.
1 · Each check is sealed
When someone logs a fridge temperature, the reading, the time, who took it and the photo are written once and given a fingerprint — a short string calculated from those exact contents.
2 · Each seal contains the last one
Every fingerprint is calculated from the record plus the fingerprint before it. So the tenth check's fingerprint depends on all nine before it. Change something early and nothing after it adds up any more.
3 · Anyone can check it
A finished inspection becomes a PDF and a link. The inspector opens the link on their own phone, presses verify, and the server recalculates the whole chain in front of them. No account, no software to install.
Try to forge it
One day of cold-chain checks
Row 3 is a real breach — a prep chiller found at 9.2 °C, four degrees over the limit. That is the row anybody would want to change. Change it.
These records are a demonstration, not a customer's. The fingerprints are calculated by the same code that signs real inspections, on the server, when you press the button.
| # | Check | Reading | Fingerprint |
|---|---|---|---|
| 1 | Cold store 1 — opening06:10 · ≤ 5 °C | 3.1 °CPass | 94eb97ea5f5c4a44… |
| 2 | Walk-in freezer06:14 · ≤ -18 °C | -19.4 °CPass | 95357b56375fa06e… |
| 3 | Prep chiller 211:02 · ≤ 5 °C | 9.2 °CFail | ebc77fbc3116c85f… |
| 4 | Hot hold — service line11:20 · ≥ 63 °C | 65.8 °CPass | 44e5e5acbddea88c… |
| 5 | Handwash station stocked16:05 | StockedPass | 36e0c7df2f526e31… |
| 6 | Prep chiller 2 — re-check after repair22:40 · ≤ 5 °C | 4 °CPass | a0ed117c6079bfd2… |
What the server computes
sha256( previousHash | canonicalJson(record) )Each record is reduced to a canonical form — keys sorted, so identical data always produces identical text — then hashed with SHA-256 together with the previous record's fingerprint. This page sends your edit to the server and the production function recalculates the chain; the verdict is not drawn in your browser.
What this is worth on a Tuesday
- A breach cannot be quietly deleted afterwards. The record says 9.2 °C, what was done about it and who signed it off — and it proves that was written on the day, not on the morning of the audit.
- An inspector gets a link instead of a ring binder. They verify it on their own phone, in Arabic or English, without an account.
- You are not trusting us to be honest about your own data. The check is arithmetic anyone can run, including you.
Isolation, encryption, backups, and what we have not certified yet: read the security page
Run it on your own shift
Open one branch free, run a real inspection, and send yourself the link. Judge the record against the one you keep today.