Technical note
Evidence that cannot change after the report is issued
A finding is only as good as what backs it. Solvex stores evidence encrypted, anchors it by digest, and freezes it in the same database transaction that issues the report.
· 2 min read · written from the shipped implementation
The anchor is the digest
Each evidence file is measured on the server — its size, its detected type, and the SHA-256 of its plaintext bytes — before it is encrypted. The digest is the chain-of-custody anchor: it is what the finding references and what ends up inside the signed report, so it is stored as a constrained column rather than a trusted value.
The bytes live in a private bucket with no public access policy of any kind, encrypted with an AES-256-GCM envelope — a per-file data key wrapped by a server-only master key, the same scheme the client vault uses. Reading a file back means an authorized, same-origin route that re-checks authorization on every request; there are no signed URLs, because a signed URL is a bearer token the database cannot recall.
Frozen in the issuance transaction
Issuance is a single database function. It registers the signed report, stamps the draft, writes a manifest of every evidence row the report was built from — ordinal, label, digest, size, type — and marks each of those rows frozen, all inside one transaction. If any step fails, none of it happened.
A frozen row's identity and content cannot be edited, and the manifest is append-only by trigger. What a report was backed by is therefore recorded at the moment it was signed and cannot be revised afterwards, by anyone, including us.
- Before issuance: evidence can be added, relabelled and removed by an operator, under audit.
- At issuance: the manifest is written and the rows freeze, atomically with the signature.
- After issuance: the manifest is immutable and the frozen rows refuse edits and deletion.
What a client sees, and what the public does not
A client reads the report and the findings it contains. Public verification confirms the report is genuine without exposing a single evidence file, filename, digest, size or storage path — the verification projection returns none of those columns, so no wording change on the page could leak them. The limit is enforced a layer below the words.