Glossary
What is a tamper-evident audit log?
A tamper-evident audit log is a record whose integrity an auditor can verify from any point back to the start. Each entry is hash-chained to the previous entry, so any modification produces an entry that does not verify.
§ 01 Definition
Detectable, not concealable.
A single altered entry breaks the chain and fails verification, and the auditor running the verification sees it. Concealing it would take re-chaining every entry after it, a wholesale rewrite, which the external anchor you configure catches; the chain alone does not.
Tamper-evident is not the same as tamper-proof. A determined actor can still attempt to alter a tamper-evident chain. What changes is the consequence: alteration is detectable rather than concealable.
§ 02 Questions
Tamper-evidence, answered.
How is a tamper-evident audit log different from an append-only log?
Append-only enforces that new entries can only be added, not modified. Tamper-evident goes further: each entry's integrity is bound to the previous entry's hash, so the chain itself becomes verifiable. Append-only is an operational discipline; tamper-evident is a cryptographic property of the chain.
What does verification actually do?
An auditor or an automated check walks the chain and recomputes the hash of each entry, comparing it to the stored hash. Any mismatch indicates alteration.
Which regulatory frames assume tamper-evidence?
NERC CIP standards expect an attributable trail that survives an audit. The EU AI Act record-keeping obligation presupposes a record that an examiner can review. DORA's recoverable obligations imply integrity through to the recovery point.
§ 03 Related
Where the term lives.
Regulatory frames