Evidence & traceability
How the evidence register works.
“Sealed”, “tamper-proof”, “timestamped” are costly words: they are only worth something if you explain how. Here is what Galyct Pro actually does to make your evidence verifiable and, in all frankness, what we do not yet claim.
Every item receives a SHA-256 fingerprint
When you upload an item (screenshot, log, letter, export), the server immediately calculates its SHA-256 fingerprint, a 64-character signature unique to that exact content.
Calculated on upload, server side
The fingerprint is taken from the original content, at the time of upload. The client does not supply it: it cannot be forged from the browser.
Detects any alteration
Changing a single byte of the file changes its fingerprint entirely. Recalculating the item’s SHA-256 and comparing it with the recorded one proves that it has not changed.
Verifiable by a third party
Anyone (you, an auditor, an insurer) can recalculate the fingerprint with a standard tool: sha256. No need to take our word for it.
Each entry seals the previous one
The audit log is not a simple list. It is a chain: each entry includes the fingerprint of the entry before it. Removing, inserting or modifying a line in the middle breaks the chain from that point on.
Append-only, sealed link by link
On every write, the server calculates fingerprint = SHA-256( previous fingerprint · timestamp · actor · action ). There is no function to modify or delete an entry: the log is append-only.
- Actor and timestamp set by the server (never by the client)
- Partitioned by organisation: one chain per scope
- Write lock: two simultaneous appends cannot fork the chain
A verification that replays the whole chain
On demand, Galyct recalculates every link from the origin and confirms that everything matches, or points to exactly the entry where the chain is broken.
- Attests to the integrity of the entire log
- Identifies the faulty entry if the chain is broken
- Returns the head fingerprint: the “seal” of the current state
Encrypted at rest, partitioned, off the web
Evidence is only worth something if it remains confidential. Uploaded items are encrypted at rest.
What it provides, and what we do not claim
A cybersecurity firm owes it to itself to be precise about its own words. Here is the exact line.
Integrity, traceability, confidentiality
- Detection of alteration of an item (SHA-256 fingerprint) and of the log (chain).
- Append-only traceability: actor and server timestamp, which cannot be forged on the client side.
- Verifiability: the chain can be replayed, the fingerprints recalculated with standard tools.
- Confidentiality: encryption at rest, partitioning, storage off the web.
The limits, stated clearly
- The timestamp is that of our server: it is not yet a qualified timestamp from a trusted third party (RFC 3161 / eIDAS).
- The sealing is cryptographic and software-based; it is not a physically non-rewritable WORM medium.
- The evidence documents facts and decisions; it does not prejudge their legal weight, which is a matter for the courts.
These limits are acknowledged areas for development, not hidden blind spots. Transparency is part of the evidence.
Evidence you can verify, not just display.
Explore the register in the demo cockpit, with sample data, or request a demo in your context.