Tamper-evident

Audit log

Each entry stores the hash of the one before it. Altering any past record breaks every hash after it, and verification points to the first break.