PurfectShield — Hash-Chain Audit

Slide 7: Compliance-grade evidence — each event carries the hash of the previous one

Append-Only JSONL Audit Log Each event carries prev_hash — tamper with any record, the chain breaks detectably EVENT_0001 (genesis) timestamp: 2026-06-12T09:14:22Z category: aws_access_key prev_hash: 00000000...0000 hash: a3f2b8...c91e valid EVENT_0002 timestamp: 2026-06-12T09:15:03Z category: stripe_api_key prev_hash: a3f2b8...c91e hash: d41c7f...2a03 valid EVENT_0003 timestamp: 2026-06-12T09:15:47Z category: patient_name prev_hash: d41c7f...2a03 hash: f81e9b...47c2 TAMPER DETECTION: modify or delete any event → chain breaks EVENT_0004 timestamp: 2026-06-12T09:16:30Z category: ssn_pattern prev_hash: f81e9b...47c2 hash: 2b04a1...d89f TAMPER DETECTABLE ⚠ EVENT_0005 (TAMPERED) timestamp: 2026-06-12T09:17:00Z category: [MODIFIED] prev_hash: 2b04a1...d89f hash: ✗ MISMATCH — chain broken EVENT_0006 timestamp: 2026-06-12T09:17:45Z category: pci_data prev_hash: ... chain unverifiable Audit Sidecar (Unix socket) Events ship to local sidecar → S3 federation at Enterprise tier. Log never contains raw values. SOC 2 CC6.1 — Audit & Integrity Controls Maps directly to access-control and tamper-evidence requirements HIPAA §164.312(b)–(c) — Audit Controls & Integrity Hash-chained evidence satisfies audit-and-integrity requirements
🏥
Healthcare
HIPAA · PHI patterns
🏦
Financial Services
PCI-DSS · SOX
⚖️
Legal
ACD · privilege patterns
🎓
Education
FERPA · student data
🛒
Ecommerce
PCI · PII patterns

Hash-Chained Events

  • Each JSONL event carries prev_hash of prior event
  • Modify or delete any record → chain breaks detectably
  • Append-only log, never contains raw secret values
  • Verification library ships in source (internal/audit)

Tamper-Evident Evidence

  • Not "we have logs" — auditor-ready evidence
  • Categories, counts, hashes — never the secrets themselves
  • Events ship over local Unix-socket sidecar
  • Enterprise: federate to your own S3 bucket org-wide

Five Industry Packs

  • Healthcare, finserv, legal, education, ecommerce
  • Plus shared base pack with common patterns
  • JSON pack files shipped with test cases
  • Extended during implementation to your data shapes

PurfectShield • GTM-002 Hash-Chain Audit Diagram • Slide 7 • Source: collat/diagrams/hash-chain.html