Tamper-evident
Tamper-evident describes a record built so that any change to it shows, even though nothing can stop someone from trying.
In plain words
Think of the seal on a jar of medicine. It doesn't stop anyone opening the jar. It makes opening it obvious. Digital records work the same way. You can't make a file impossible to edit. You can make every edit detectable.
That is a more honest goal than "tamper-proof", which no software can promise. A record is tamper-evident when a checker can tell, with confidence, whether it is the same as when it was sealed.
An example
Someone edits the payment terms in a signed service agreement PDF and saves it. The text looks fine on screen. But the PDF's seal no longer matches the bytes, so any PDF reader that checks signatures reports that the document was changed after signing.
How it shows up in docuinked
Two parts of docuinked are tamper-evident.
The signed PDF. One PAdES seal with an RFC 3161 timestamp covers the finished file. Change it and the seal breaks. Check any file with the free PDF checker.
The event log. Each event includes the hash of the one before. Editing an old entry breaks every entry after it. An insider could, in theory, rebuild the whole chain. So docuinked has an outside authority timestamp a checkpoint over the log every hour. A rewrite after a checkpoint would show. The window is up to an hour, and we say so.
Common confusions
Tamper-evident is not tamper-proof. Be wary of any vendor that claims the second. Files on a computer can always be changed. What matters is whether you can tell.
Evidence of a change is not evidence of who changed it. A broken seal tells you the file differs. It doesn't say why or by whom. That is a matter for the people involved.
Encryption is a different control. docuinked also encrypts stored PDFs, which keeps them private. Tamper evidence is about integrity, not secrecy.
Related terms
Read our security page for the full list of controls and the ones we don't have yet.
Sources
Checked 2026-11-07.
Common questions
Why not make the log tamper-proof instead?
Nobody can do that honestly. Anyone who controls a machine can change what is on it. The useful promise is that a change will be visible to a checker.
What does the hourly checkpoint protect against?
It stops a quiet rewrite of the whole log after the fact. Once an outside authority has timestamped a checkpoint, the history before it is pinned.
Does adding a comment to a signed PDF break the seal?
Saving any change to the file, including an annotation, alters its bytes. A signature check will then report the document as modified after signing.
Related
Try it in test mode
Free during the beta. Test keys send no email, so you can build the whole flow first.