A compliance platform earns exactly as much trust as its weakest guarantee. Attrace's guarantees are cryptographic, not contractual — built into the architecture from day one, because they can't be bolted on later.
Every ledger entry — import, mapping, validation, review, approval, submission, auditor access — carries a SHA-256 hash computed over its contents and the hash of the previous entry. Alter any historical record and every subsequent hash breaks. The chain can be independently recomputed by your auditor, or by you.
Entries are timestamped under RFC 3161 by an independent timestamping authority — legally admissible proof that a record existed at a point in time, not just a database column claiming it did.
Approvals are signed, not clicked. Biometric confirmation on mobile binds a specific person to a specific document version — the approval chain holds up because each link in it does.
Auditor access is read-only, scoped to engagement entities and periods, and expires automatically. Every access event is itself written to the ledger — the audit trail includes its own audience.
TLS 1.2+ in transit, AES-256 at rest. Enterprise customers can bring their own keys (BYOK), keeping key custody inside the firm.
UK-only or EU-only residency options on Enterprise — submission data, evidence and ledger entries stay in the jurisdiction you choose.
Strict per-firm data isolation enforced at the database layer with row-level security — designed for regulated multi-tenancy, not retrofitted to it.
Role-based permissions mirror the approval chain — preparers prepare, reviewers review, approvers sign. SSO and enforced MFA for every account.
UK and EU GDPR compliant, with data processing agreements as standard for every customer and documented sub-processor lists.
Deadline-critical software gets deadline-critical operations — monitored around the clock, with status transparency and tested recovery procedures.
Attrace is built to SOC 2 Type II control standards from the start, with certification targeted within 18 months of launch. Enterprise customers get evidence sharing along the way — control documentation, penetration test summaries and audit progress, not a "trust us" page.
"Audit log immutability needs to be real, not theatrical. Cryptographic guarantees take careful design — which is why they're the first thing we designed."From the Attrace product principles
Every action you take in the demo writes a hashed ledger entry, live.