Chain-of-custody reports for UK disclosure and regulatory work

Why the hash matters

Chain of custody answers a single question: is the file in front of the tribunal the same file that was collected, and can you prove what happened to it in between? A SHA-256 hash taken at collection is the anchor — any later copy either matches it or does not.

The report records the hash at intake, the hash after each processing step (redaction, conversion, Bates numbering), the operator responsible, and a trusted timestamp for each event, so the transformation from native file to disclosed exhibit is fully accounted for.

Fits UK disclosure practice

The format is built around what UK courts, employment tribunals and the ICO actually ask for during disclosure and investigation: provenance, integrity, and a documented handling trail. It attaches cleanly to a CPR Part 31 disclosure schedule or an internal incident file.

Use it alongside permanent redaction and PDF flattening so the exhibit you produce is both safe to disclose and provably unaltered afterwards.

What the report contains

• SHA-256 hash of the original file at intake
• Filename, size, MIME type and detected format
• Every processing step with operator identity and timestamp
• Output hash after each transformation
• Trusted timestamp for the report itself
• A plain-English integrity statement suitable for a witness exhibit

Frequently asked questions

Is this accepted in UK employment tribunals?

The report captures the provenance and integrity evidence tribunals expect and is commonly attached as an exhibit. It supports, rather than replaces, the witness evidence of the person who collected the document.

Can I produce a report for a document I redacted here?

Yes — that is the intended workflow. Redact or flatten the file first and the report records the input hash, the transformation and the output hash as separate, timestamped events.

How long is the report valid?

Indefinitely. The hashes and timestamp remain verifiable after the 60-minute purge of the underlying file, which is exactly why the hash rather than the document is the evidential anchor.

What happens to the documents I upload?

Every uploaded file is permanently deleted from DocumePro servers within 60 minutes under our Non-Persistence Guarantee. Nothing is retained for analytics, shared with third parties, or used to train AI models.