Security

Auditable down to the log line.

Every action — upload, classify, approve, sign, delete — lands in an immutable, cryptographically chained log: append-only enforced at the database level, externally time-anchored daily (OpenTimestamps + RFC 3161) — offline verifiable by any auditor with the open-source rt-verify tool. Electronic signatures with a tamper-evident audit chain; qualified signature (eIDAS QES) via trust service provider in preparation. GDPR-erase included.

Postgres RLS per tenant — we can't see your data either

Immutable, cryptographically chained logging: append-only enforced at the database level, externally time-anchored daily (OpenTimestamps + RFC 3161) — offline verifiable by any auditor with the open-source rt-verify tool

Electronic signatures with tamper-evident audit chain; qualified signature (eIDAS QES) via trust service provider in preparation

Sigstore attestation on every container image

Confidential compute (AMD SEV-SNP) optional

GDPR-erase across every store, including embeddings and cache

Nachrechenbar statt behauptet

Der Prüfer verifiziert selbst — ohne Zugang zu Ihrer Instanz.

RecordTailor exportiert das Beweispaket zu einem Zeitraum als in sich geschlossenes Bundle: Dokumente, Ereignis-Historie, Hash-Manifest und die externen Zeitanker (OpenTimestamps und RFC-3161-Zeitstempel). Ein Prüfer öffnet das Bundle mit dem quelloffenen Kommandozeilen-Tool rt-verify auf dem eigenen Laptop und rechnet die Kette lokal nach — kein Netz-Zugang, kein Vertrauen in unsere Datenbank, keine Marketing-Zusagen. Wenn die Kette hält, sehen Sie es. Wenn sie kippt, auch.

An audit log that can't be rewritten.

Every event gets a SHA-256 hash that includes the hash of the previous one. A database trigger enforces append-only — UPDATE and DELETE on the log table are physically impossible; content deletions run through legal-hold and retention checks. Once per day the chain head is externally time-anchored (OpenTimestamps and an RFC-3161 timestamp authority); a nightly self-check reconciles the chain against the latest anchor. Verified with the open-source rt-verify tool — offline, without access to the production instance.

$ rt-verify ./beweispaket-2026-Q2.bundle
✓ 41 837 events read from bundle
✓ Hash chain intact through 2026-07-20 14:03:24
✓ Append-only trigger signature: verified
✓ External time anchor (OpenTimestamps): matches Bitcoin block 897 214
✓ External time anchor (RFC 3161, A-Trust TSA): matches 2026-07-21T02:14:07Z
✓ Digital signatures: 41 837/41 837 valid
ℹ eIDAS QES (PAdES-B-LTA) via A-Trust: in Vorbereitung