Verification
Arbiter keeps three kinds of proof distinct: day-to-day GRC work, SHA-256 fingerprints on evidence, and optional ledger anchoring on Stratum. Mixing those claims overstates what a given deployment proves.
Three layers
| Layer | Maturity | What you get |
|---|---|---|
| Operational | Live | Dashboard + APIs: risks, controls, policies, incidents — role-scoped work |
| Hash-chained | Live | SHA-256 fingerprints on evidence and package manifests — tamper-evident without a ledger |
| On-chain | Available by arrangement | Metadata-only Seal onto Stratum; UI proof badge: Verified on-chain |
Every live deployment fingerprints evidence with SHA-256. That is tamper-evident integrity — not a ledger seal. Language like “cryptographically sealed” or the Verified on-chain badge applies only when Stratum sealing is entitled and configured for that tenant.
What a hash proves
A SHA-256 fingerprint proves:
- The bytes (or published digest) you have now match what was fingerprinted then
- If the file or package changes, the fingerprint no longer matches
A hash does not prove:
- That an assessor agreed with your control narrative
- That Arbiter’s internal review was correct
- That a record was anchored on a ledger
What a seal proves
When Stratum sealing is entitled and configured, a seal proves:
- A published digest was anchored (metadata-only) on the ledger path Arbiter uses
- The UI may show Verified on-chain for that sealed artifact
A seal does not prove:
- Correctness of risk scores or review conclusions
- That NPI or evidence bytes were placed on-chain (they are not)
- Availability on every tenant by default
MVP honesty: sealing configuration is environment-specific in early deployments. Confirm with your BlockSkunk contact what is configured for your org.
Vocabulary
| Term | Use |
|---|---|
| Seal (verb) | Action that anchors a published digest to Stratum |
| Verified on-chain | Proof badge after a successful seal |
| Hash-chained / SHA-256 fingerprinted | Default integrity for every live deployment — no ledger required |
NPI boundary
Non-public information (NPI), secrets, and raw evidence bytes do not ride the on-chain path. Partner and seal envelopes stay metadata-oriented — see Records.
For the three-line public disclosure test and what this docs set never claims, see Disclosure Boundary. Surface maturity for sealing: Integration Surfaces.