Evidence they can check
without trusting you.
When a dispute starts, the evidence is usually screenshots and memory, and the other side has no reason to believe any of it. XO Ledger records platform events in an append-only, hash-linked chain that refuses edits and deletions, and lets you hand someone a bundle they verify for themselves.
An audit log you can read is not evidence
Most systems have a log. The question that matters is whether anyone on the other side of a dispute has a reason to believe it.
The record refuses to change
Recorded events cannot be edited or deleted. Not by policy, not by convention: the system refuses updates and deletions outright.
Someone else can verify it
Export a bundle and hand it over. They run the verification themselves, offline, with no access to BrieXO and no need to take our word for anything.
A failure to record stops the work
If an event cannot be recorded, the action that caused it fails rather than proceeding quietly. A gap in the record is treated as a fault, not as an acceptable outcome.
What a checkable record changes
Recorded events cannot be edited or deleted. The system refuses both.
You can hand someone a bundle they verify themselves, without access to BrieXO.
If something cannot be recorded, the action that caused it fails rather than proceeding quietly.
Record, export, verify
Three steps, and the third one happens on somebody else's machine.
An append-only, hash-linked record
Platform events are written into a chain where each entry is linked to the one before it by hash. Changing an entry after the fact breaks the link, which is what makes the chain worth checking.
- Updates and deletions refusedNot discouraged or logged, refused outright
- Hash-linked entriesEach entry carries the hash of its predecessor, so tampering shows
- Recording failure blocks the actionThe work stops rather than proceeding unrecorded
Export exactly the slice that is in question
Scope an evidence export by project, by period, by resource or by person, so a dispute about one elevation in one month does not require handing over everything else.
- Scoped four waysProject, period, resource or person
- Write-once bundlesA retention policy applies to the export bundle once it is produced
- Excluded without alteringNarrowing an export never edits the underlying record
Verification that happens on their machine
The point of the bundle is that the recipient does not have to trust you. They run the verification themselves, offline, and it either passes or it fails on a tampered bundle.
- Offline, independentNo access to BrieXO required to check it
- Fails on tamperingA modified bundle does not quietly pass
- Personal-data fields strippedNamed personal-data fields are removed before entries are written
Where XO Ledger sits in the platform
The Ledger is platform infrastructure. It is always on, included with every bundle, and never sold separately.
Recording
Apps across the platform write events into the chain as work happens, rather than assembling a record afterwards.
Export
A scoped bundle is produced for the project, period, resource or person actually in question.
Independent verification
The recipient checks the bundle offline. Verification passing is a statement about the bundle, not a statement about us.
Frequently asked questions
Can anyone edit the record?
No. The system refuses updates and deletions outright, so a recorded event cannot be changed or removed after the fact.
How would someone else check it?
You export a bundle and hand it over. They run the verification themselves, offline, with no access to BrieXO. A tampered bundle fails the check.
What exactly does the chain prove?
That entries have not been altered since they were written. Each entry carries the hash of the one before it, so changing one breaks every link after it.
Does it prove who did something?
Authorship is a separate question from integrity, and we do not claim the record settles it on its own.
What happens to personal data?
Named personal-data fields such as email, name and phone are stripped before entries are written. It is a field-name filter rather than personal-data detection, so data carried under a neutral key is not caught by it.
Evidence that survives the argument
See how a scoped export is produced and how someone outside BrieXO verifies it.