Same SHA-256 algorithm as dcomply production

Consent Integrity Demo

This tool runs the exact SHA-256 hash-chain algorithm from dcomply's production EvidenceChain. Grant sample consents, tamper with any row, and watch the downstream rows break. It is the same math a regulator would run offline against your DPBI export bundle.

Sample ledger · hash-chained

consent.granted

7a3f…91cb

consent.granted

3d1e…a842

consent.withdrawn (tampered)

expected 9f2a… got b7c1…

Break

dsr.requested

chain broken above

Void

verify()

Broken at row 3

1Grant sample consents

Each click appends a row. The current_hash is computed as SHA-256(prev_hash + canonical_json + timestamp). This is the same code path used inside dcomply's EvidenceChain::append().

Chain status

No events yet. Click a button to append the first row.

2The tamper-evident ledger

Click Tamper on any row to alter its payload. Then click Verify chain. The tampered row and every row after it will fail.

#	Event	Payload (canonical JSON)	Prev hash	Current hash	Status	Actions
Ledger is empty. Append events above.

The algorithm (in-browser)

Byte-for-byte identical to dcomply's production EvidenceChain::append().

// current_hash binds three things: // 1. the previous row's hash (chain link) // 2. the canonical JSON payload (content) // 3. the ISO timestamp (time) const canonical = JSON.stringify(payload); const input = (prevHash || '') + '|' + canonical + '|' + occurredAt; const currentHash = await sha256(input); // Tamper with any field → currentHash changes → next row's // prevHash reference is now stale → verify() catches it.

Why this is a big deal

A conventional audit log records that consent was granted, but the row can be rewritten at any time by anyone with database access. To a regulator, that is a claim, not evidence.

EvidenceChain uses SHA-256 chaining so any historical rewrite invalidates every subsequent hash. The verify(tenant_id) walk returns the id of the first inconsistent row. Regulators can rehash your evidence bundle offline and get the same answer without trusting dcomply.

See the full architecture on /proof →

Get real EvidenceChain on your data

This demo is educational. Your real chain in dcomply covers consent, DSR, breach, DPIA sign-off, vendor DPA, and every connector event.