A custody chain that is implemented, not asserted.
Every file is fingerprinted, every step is recorded — as the work happens, not reconstructed later. And because every event is hash-linked to the previous one, modification, deletion, reordering, and insertion are all detectable on verification.
Every event, chained to the last.
The custody chain is a hash-linked ledger. Each event carries its own hash and the hash of the event before it — so the recorded sequence either reproduces exactly, or the discrepancy shows.
- Anatomy of an event: sequence, type, phase, canonical content, its own hash — and the hash of the previous event.
- Written while the work happens: allocation, capture, transfer, storage, access, and retention are recorded live — never backfilled.
- A full taxonomy of phases — setup, capture, processing, orchestration, access, and retention — so every event has a precise place in the lifecycle.
- Tamper-evident by construction: recomputing the chain detects modification, deletion, reordering, and insertion of events.
Integrity from the first byte.
Every file Provena preserves gets a cryptographic hash — a digital fingerprint. If you have never met one, here is everything you need to know.
One capital letter changed — and every character of the fingerprint changed with it.
A file only becomes evidence after its integrity survives the trip from the capture environment to storage.
- Three hashes per file: SHA-512 as the canonical reference, plus SHA-256 and SHA3-512 — supplementary fingerprints from different hash families.
- Transfer integrity: hashed at origin, re-hashed at destination, stored only when the values match.
- Idempotent uploads: a retried upload with the same identity is recognized as a duplicate, never a second record.
One ZIP package, fully inventoried.
Everything a session preserves is consolidated into a single evidence package — a standard ZIP archive, openable anywhere — with a manifest that lists every file, its path, size, and hash.
- A standard ZIP, branded and self-identifying — named after the session, recognizable in any inbox, and openable with any tool (or in the browser, with the package viewer validating the SHA-512 first).
- The manifest is the inventory: missing, unexpected, or substituted contents show up against it on review.
- The package hash — SHA-512 — fixes the whole set, and is the value registered with external-proof providers.
Two seals — then the trail continues.
Sealing is not the end of the record. After the package and the chain are fixed, access itself becomes part of the history.
Fixes the evidence set: the consolidated ZIP package and its manifest — every file, frozen as one unit.
Fixes the recorded history itself: the sealed head of the custody chain — including how the session ended.
- An access trail after sealing: report views, package downloads, and public checks are recorded as custody events.
- Material events are never collapsed — only repeated views of the same material within a bounded window are deduplicated, so the chain stays honest without inflating.
- Both seals can be anchored independently with external-proof providers — the package hash and the custody seal each get their own registration.
- Deletion is part of the story: controlled deletion removes stored files while the custody ledger keeps the procedural account of what happened.
The seal is what the world attests.
The package hash and the custody seal are exactly what independent external providers register — proof that stands even without trusting Provena.