TECHNOLOGY

How the record works, for those who want the machinery.

Nothing here is required reading. The rest of the site says what the record does in plain words; this page names the mechanisms, and the security page states the controls.

Walk through it on a live system The controls, named
$ openssl ts -verify -in deal_8821.tsr -data evidence_pack.zip
Verification: OK

Timestamp verification, run on a real pack. Something a reviewer executes, not a screenshot anyone is asked to accept.

EVIDENCE-FIRST
e4b1f2…⟶9c07ad…⟶53fe21… ✓ INDEPENDENTLY TIMESTAMPED✓ SIGNED

The record is checked on the reviewer's own machine.

An evidence pack is checked with free standard tools, on the reviewer's own machine. Integrity, attribution and time are the three things an auditor or a tribunal asks of a record, and the check establishes them narrowly: the documents are unchanged, they came from where they claim, and they existed at the stated moment, because the timestamp comes from an independent authority. Whether the record satisfies a particular legal standard remains counsel's question; the integrity and the date do not depend on anyone's word, and nothing in the check needs Exedra Gate's permission.

  • Chained in order. If anything is changed, inserted or reordered afterwards, the record itself shows it.
  • Independently timestamped. A clock that is not ours establishes when, in the RFC 3161 format standard tooling already verifies. Fail-closed by design: when timestamping is required, no valid timestamp means no evidence pack, because the system declines to produce a record it cannot prove.
  • Signed at origin: who produced it, and that it is intact, checkable offline, years after the deal closed.
One record, from the action to the reviewer

An action is recorded as it happens, and Exedra Gate fingerprints it. Each entry carries the fingerprint of the entry before it, so a change, an insertion or a reordering stops the chain matching. The pack's contents are listed in a manifest and signed at origin, establishing who produced it and that it is intact. The signed pack is then timestamped by an authority that is not Exedra Gate, in the RFC 3161 format, which is what establishes when it existed. The pack is finalised, and it fails closed: where timestamping is required, no valid timestamp means no evidence pack at all. Years later any reviewer runs seven independent checks offline with free standard tools. A hash chain detects tampering; it does not prevent it.

The three fingerprints are the ones printed at the top of this section, because this is one record and not a second example. What the last row establishes is narrow and checkable: the documents are unchanged and existed at that moment. A hash chain is tamper-evident, and we do not describe it as tamper-proof.
THE VERIFIER, NAMED

exedragate-verify

A page that keeps saying "verifies offline" owes the reader the thing that does the verifying. It has a name. exedragate-verify is a standalone command-line verifier that runs seven independent checks against an exported pack: the hash chain recomputed end to end, the origin signature, the independent timestamp, the pack's internal consistency, its own generation event, the attribution of every action, and the PDF cross-checked against the pack's manifest. It makes no network connection, and the timestamp authority's trust anchors ship inside it. It is available on request, to clients and to the people checking up on them alike, and the timestamp also verifies with standard OpenSSL, so nothing rests on our tooling at all.

The exact mechanisms, named → Security

◲ Visual · coming soon Evidence-pack verification evidence-verify
What the chain actually does

Each entry carries a fingerprint of the entry before it, so a change, an insertion or a reordering stops the chain matching. Entry one: an action is recorded, fingerprint e4b1f2. Entry two carries the previous fingerprint and its own, 9c07ad. Entry three carries the previous fingerprint and its own, 53fe21. The pack is then timestamped by an independent authority and signed at origin, so a reviewer can confirm offline that it is unchanged and existed at that moment. A hash chain detects tampering; it does not prevent it.

Change, insert or reorder anything in the middle and the fingerprints stop matching, so the record shows it. That is detection, not prevention. A hash chain is tamper-evident, and we do not describe it as tamper-proof.

Beyond memory.

SECURITY, NAMED

Mechanisms, named. Not adjectives.

Tenant isolation Postgres row-level security on every tenant-scoped table. Separation is enforced in the database, not in the application.
Strong authentication Signing in takes a phone, not just a password: an authenticator app today, device-bound passkeys shipped for signing on mobile. No SMS or email one-time codes, the channels regulators are phasing out.
Fail-closed evidence When timestamping is required, no valid timestamp means no evidence pack. The system declines to produce a record it cannot prove.
Data protection Engineered to support obligations under GDPR, Switzerland's revised FADP, and further regional regimes, including correction rights for individuals named in screening.
Offline verifiability Evidence packs verify with standard tooling, independent of Exedra Gate’s servers.
What is in the record, and what is not Documents, signatures and document access are part of the evidence record. Messages between parties are not, and we do not describe them as evidence.
Data residency Managed cloud in-region today. In-jurisdiction and sovereign-cloud deployment is scoped and delivered as an implementation engagement.

The published documents behind those mechanisms.

Each entry names the document a mechanism above implements, and the body that issued it. Naming a framework means the platform was engineered to its published requirements. It does not mean Exedra Gate is licensed, supervised or endorsed by any authority.

  • EU / CH GDPR and the Swiss revised FADP Tenant isolation enforced in the database itself, with defined retention and a documented route for correcting a record. Regulation (EU) 2016/679; Federal Act on Data Protection, SR 235.1
  • EU eIDAS advanced-signature criteria (Art. 26) A signature uniquely linked to its signatory and to the document, so a later change to either is detectable. Advanced, not qualified. Regulation (EU) No 910/2014, Art. 26
  • IETF RFC 3161 timestamping The time on the record comes from an independent authority, not from us. Admissible evidence of when a document existed. Time-Stamp Protocol (TSP), RFC 3161
  • IRTF / NIST Ed25519 and SHA-256 Published algorithms, so an evidence pack can be checked with ordinary tooling by someone who does not trust us. Edwards-Curve Digital Signature Algorithm (EdDSA), RFC 8032; Secure Hash Standard (SHS), FIPS 180-4
  • W3C WCAG 2.1 AA Audited against with axe, page by page, which is what a public-sector or institutional procurement review asks for. Web Content Accessibility Guidelines 2.1, Level AA

What naming a framework means →

◲ Visual · coming soon The audit trail, as a reviewer sees it tech-audit-trail
The vocabulary, defined.
Every term used above is defined in one sentence each on the security page, alongside the controls a compliance officer checks for, and the verification commands a reviewer runs independently.