Record Integrity and Tamper-Evidence Standard

The value of a service register rests entirely on one proposition: that a record, once published, cannot be quietly changed, backdated or removed. This Standard sets out how that proposition is enforced.

The controls in this Standard are enforced at database level, not only in the interface. A route that bypasses the interface does not bypass the control.

A record in the published, amended or withdrawn state cannot be modified. Attempted modification is rejected by a database-level protection, irrespective of which credential is used or which interface the request arrives through.

No entry is ever deleted. Removal from public view is achieved by restriction or withdrawal, both of which preserve the underlying data and the reason for the change.

The publication timestamp is written by the Register at the moment of publication and cannot be supplied, changed or backdated by a workshop.

A record qualifies as workshop-verified only where it is submitted within the published submission window of the date the work was carried out. The window is a platform setting, published with a rule version, and applied automatically at submission.

A record submitted outside the window is accepted but classified as historic rather than verified, with the classification reason recorded and displayed. This prevents retrospective construction of a service history.

The rule version in force at the time of submission is stored on the record, so that a classification can always be explained by reference to the rule that produced it.

A correction to a published entry is made only by amendment. An amendment request states the reason and the specific changes sought, and is reviewed by the Register.

On approval, the Register: (a) writes an immutable snapshot of the superseded version; (b) increments the record's version number; (c) applies the approved changes; (d) issues a replacement certificate bearing the new version; and (e) notifies the affected parties.

The superseded version remains inspectable. A viewer of an amended entry can see that it has been amended, when, at whose request, and for what reason.

An amendment is refused where it would materially alter the substance of the work declared, rather than correct an error in recording it. Such cases are handled as a disputed record.

Every published entry carries a unique, permanent certificate identifier in the form NVSR-SVC-YYYY-XXXXXXXX. The identifier is bound to the entry and its version.

A superseded certificate identifier continues to resolve and is shown as superseded, with a pointer to the current version. Identifiers are never reissued or reused.

Verification of a certificate is recorded as a verification event, so the Register can detect enumeration attempts and unusual verification patterns.

Evidence attached to an entry — photographs, measurements, invoices and parts documentation — is stored privately and released only through short-lived signed links to entitled parties.

A content hash is recorded for uploaded evidence so that substitution of a file can be detected.

Every material action writes an audit event capturing the actor, the action, the entity, the previous and new state where applicable, and the reason given.

Audit events cannot be updated or deleted by any application role. An administrator can read the audit trail; no one can rewrite it.

Scheduled monitoring raises risk events for indicators including: mileage recorded lower than a previous entry, implausible mileage progression, duplicated evidence across entries, records entered by a workshop whose insurance has lapsed, and work recorded against an expired technician qualification.

A raised risk event is triaged by the compliance function. Where a record is materially in doubt, it is placed under review and publicly flagged while the investigation proceeds.