Immutable Evidence Analysis

DELETE ONE ROW.
BREAK THE CHAIN.

A database log is a claim someone can edit. NonaShield's evidence record is a hash-chained, dual-signed, write-once ledger — tampering with one entry is mathematically detectable.

// Hash-Chain Construction

Every evidence record's chain hash is SHA-256(previous record's hash + this event's hash), assigned a monotonic chain index under a row lock. Every tenant chain starts from a fixed genesis constant — deleting or reordering any record breaks every hash after it.

SHA-256 Chained Fixed Genesis Anchor Verified Every 30 Minutes

// Dual Signature

Device signature — ECDSA P-256, signed on-device against the hardware key.
Server signature — ECDSA P-256, signed against the tenant's KMS key.
Non-repudiation from both the originating device and the server — not just one.

!!! WORM STORAGE

Not even the root
account can delete it.

Every signed evidence object is written under S3 Object Lock in COMPLIANCE mode — not the weaker "Governance" mode — with a default 5-year retention. If Object Lock can't be applied, the write fails closed rather than silently storing an unprotected copy.

ObjectLockManager: COMPLIANCE mode

Retain-until date cannot be shortened or deleted by any account, including the AWS root account.

CHAIN_VALIDATOR.log

Step 1 — Recompute prior hash

Chain hash = SHA-256(previous hash + event hash)

Step 2 — Compare to stored value

Stored hash == recomputed hash

Step 3 — Any mismatch

CHAIN_BREAK detected // fail-closed, never silently extended

// Regulator-Mapped Export

Every export bundles event ID, device identity, threat ID, rule metadata (version + hash), model metadata (name, version, hash, feature-schema version), and the hash-chain proof itself — then a signed, human-readable PDF report for RBI/NPCI SAR submission.

// On-Device Buffer

Before it ever reaches the backend, each threat event is stamped with a monotonic sequence number and signed on-device, buffered, and flushed both event-driven and on app-background — so evidence isn't lost even offline.

What We Don't Overclaim

The evidence signing architecture is designed hybrid: a mandatory classical ECDSA P-256 signature today, with a defined extension point for a post-quantum signature layered alongside it. That post-quantum signer is a documented stub, not yet active — we say "hardware-rooted, dual-signed evidence" because that's what ships today, and we don't market "quantum-resistant" as a live capability until it is.

The Verdict.

"A log tells you what happened. A hash chain proves nobody changed the story afterward."

Hash-Chained, WORM-Stored

Request Live Simulation →

DELETE ONE ROW. BREAK THE CHAIN.