Defence counsel attacks
exactly this seam.
Every transfer of evidence requires a releasing signature and a receiving signature. Those land on a custody form — a piece of paper that travels with the item, gets photocopied, sits in a drawer, and is the first thing attacked at trial. The chain is only as strong as the least documented handoff in it.
Releasing and receiving officer · sealed at the transfer · chained to the previous handoff
Custody transfer · sealed
● 2 of 2 signedItem 2026-4471-A · sealed kit
Patrol → property room
J. Mercer · releasing
Badge 4471 · signed 23:12:08D. Vasquez · receiving
Badge 2290 · signed 23:12:39Sealed — both signatures verify
Editing anything breaks it visiblyWhy the paper chain gets attacked.
Not because officers are careless. Because a signature on a form is the weakest possible artefact for something a conviction may rest on.
A gap is indistinguishable from tampering
One missing or illegible signature does not prove anything went wrong — but it does not prove anything went right either, and that is all reasonable doubt requires.
The form travels with the item
Custody paperwork is handled by everyone who handles the evidence. The document meant to detect interference passes through every set of hands that could interfere with it.
Times are written by hand
A handwritten time is a claim about when something happened, made by someone with an interest in the answer.
What a real transfer seal looks like.
Both people sign the same record, at the moment it happens, each bound to their own credential. Neither can produce it alone.
Both officers sign the same record
Item, condition, location and time are sealed as one record signed by releasing and receiving officer together — not two signature blocks that may have been filled at different moments.
The badge is captured, not asserted
Each signature carries the signer’s credential and role as part of the sealed content, so identity is not a matter of handwriting.
One officer cannot self-transfer
If both signatures resolve to the same credential the record refuses to seal, which is what a custody transfer means in the first place.
Each transfer links to the last
Every handoff is hash-linked to the one before it. Removing or altering a link breaks every subsequent one, so the chain either verifies end to end or shows exactly where it stops.
Who this protects.
The officer
A transfer record they could not have altered is a far better answer under cross-examination than a signature and a recollection.
The prosecution
A chain that verifies mathematically is not the same kind of exhibit as a photocopied form.
The defendant
This cuts both ways, deliberately. A chain that can be checked independently protects the innocent from a chain that was never real.
Where this actually stands.
We’d rather tell you plainly than let you find out on a call.
What exists today
- The two-person seal is built and tested in our signing library
- Self-witnessing is refused at the cryptographic layer, not by policy
- Tamper-evidence and independent verification already run in our live review product
- The signing key is published, so anyone can verify a sealed record without an account
What does not exist yet
- A field-facing capture flow that works at a scene, offline
- Integration with any evidence management or RMS system
- Per-signer keys — credentials are captured, but signing runs on a service key today
- Any deployment in a live law enforcement setting
So this is a pilot conversation, not something you can buy this afternoon. If the problem is real where you work, that’s exactly who we want to build the first one with.
Talk to us about a pilot.
The founder reads every message and will tell you honestly whether this is ready for what you need.