The evidence journal

Every decision recorded, chained and timestamped, so you can show what you did and when.

Under Evidence journal, every decision you record is kept in order: products added and changed, releases uploaded, vulnerabilities assessed, reporting cases opened and reports marked as submitted, exercises, policies written, documents reviewed, advisories published.

Why it can be trusted

Each entry carries the hash of the one before it (SHA-256): changing or removing an entry breaks the chain.
Once a day, the latest hash is timestamped by an outside authority (RFC 3161), which proves the journal existed in that state at that date.
Export the journal (JSON) gives you the whole chain. The open-source command provetry verify-journal checks it on your own computer, timestamps included.

What it is for

If a market surveillance authority asks what you did about a vulnerability and when, the journal answers with dates that you could not have changed afterwards.

Still stuck? Write to us at hello@provetry.com.