The chain of custody
Every hand-off of an evidence item from collection to court: who, when, where, and under which seal.
From the moment evidence is collected to the day a court orders it sealed or destroyed, every hand-off and release is on a tamper-evident record, with access logged at the level you set. Prosecution, defense and the court can each verify what they hold.
In court, a record is only as good as the history behind it.
Every hand-off of an evidence item from collection to court: who, when, where, and under which seal.
Whether the file presented in court is the one collected, and whether any record about it changed afterward.
Whether anyone outside the order could find a sealed case, and every access by those who could.
Every item disclosed, which version, in which disclosure, and when.
Proof that records were destroyed when a court ordered it, approved by the right people, with the history intact.
Who signed the order, what the signature meant, and that the text is the one signed.
Each transfer is an event record, captured once and locked: from, to, time, place and seal. A correction is an amendment with a reason, and the original stays visible.
Each file is stored encrypted with its digest checked on every read and re-verified on a schedule. Versions are never edited, and the hash-chained ledger shows any change.
A sealed flag on a case flows to its members, and policy hides both from everyone outside the order. Search results, lists and counts treat hidden and missing the same way.
Each discovery release is a sealed, signed bundle the defense can verify offline. For any recipient, the accounting lists every version released, with digests.
Where the deployment allows early destruction, an order needs two distinct approvers and is refused while a hold applies. Destroying the key makes the content unreadable, while the record's identity and history remain and the ledger still verifies.
A signature records its meaning, such as "ordered", binds the exact version, requires a fresh sign-in, and adds a signature page to a new PDF/A.
| Record | Kind | What it holds |
|---|---|---|
| Incident case 24-1187 | case record | Reports, evidence items and custody transfers as ordered members; a sealing order flows to every member. |
| Custody transfer | event record | Item, from, to, time, location and seal number, locked at capture. |
| Digital evidence file | document | Kept as its exact bytes with no conversion, scanned before it is served, its digest checked on every read. |
| Docket filing received | event record | The filing party, the time received and a link to the exact version filed. |
| Court order | document | Signed with the meanings the court configures, bound to the exact version signed, and superseded only by a later order. |
Kubernetes, PostgreSQL, an S3-compatible object store, a key manager, an RFC 3161 time stamping authority, an OIDC identity provider and a malware scanner. It runs in any cloud or on premises, is designed for air-gapped networks, and never calls home.
Yes, under the reader's own permissions. Returned content is delimited and tagged by source, and when an agent reads another party's text its session trust drops and it may write less. The model does not have to behave for this to work.
Yes. An inspector session gives read-only access, fixed in scope, for at most 72 hours, closed by the clock or on demand. Every access is logged.
Your product keeps its intake, scheduling and courtroom screens. Tabellix is the record underneath, with custody events, sealing, signatures, disclosures and the audit trail through one contract over gRPC, REST or MCP. Your brand appears on every customer-visible surface Tabellix provides.
Tell us what you build and who audits it. We'll show you how Tabellix fits into your product and how it answers your auditors' most common questions.